New API 0.10.8 Alpha 4
Approved changes feed: RSS · Atom
cpe:2.3:a:newapi:new_api:0.10.8:alpha4:*:*:*:*:*:*part: a version: 0.10.8 update: alpha4
| Vendor | Newapi (6e38d999-40be-58a3-bf1f-b693e7f7fa9d) |
|---|---|
| Product | New Api (4d563535-ddf4-5b5c-bac8-09df55ef751a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/quantumnous/new-api |
purl2cpe | 2026-07-28 16:40:52.941613 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-25802 |
vulnerable | 2026-06-08 07:53:20.497003 |
New API has Potential XSS in its MarkdownRenderer component
HIGH (7.6)
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.9, a potential unsafe operation occurs in component `MarkdownRenderer.jsx`, allowing for Cross-Site Scripting(XSS) when the model outputs items containing `<script>` tag. Version 0.10.8-alpha.9 fixes the issue.
Published: 2026-02-24T00:42:45.515Z
Updated: 2026-02-26T14:58:43.459Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25591 |
vulnerable | 2026-06-08 07:53:20.065160 |
New API has an SQL LIKE Wildcard Injection DoS via Token Search
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.10, a SQL LIKE wildcard injection vulnerability in the `/api/token/search` endpoint allows authenticated users to cause denial of service through resource exhaustion by crafting malicious search patterns. The token search endpoint accepts user-supplied `keyword` and `token` parameters that are directly concatenated into SQL LIKE clauses without escaping wildcard characters (`%`, `_`). This allows attackers to inject patterns that trigger expensive database queries. Version 0.10.8-alpha.10 contains a patch.
Published: 2026-02-24T00:41:30.198Z
Updated: 2026-02-26T14:57:18.199Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.