Product by Newapi
New API
9 known vulnerabilities in New API (Newapi), 0 of them actively exploited (CISA KEV).
Key figures
9
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-41432 | New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud | 8.2 | |
| High | CVE-2026-33655 | New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs | 7.7 | |
| High | CVE-2026-25591 | New API has an SQL LIKE Wildcard Injection DoS via Token Search | 6.5 | |
| High | CVE-2025-55573 | New API: Cross-Site Scripting (XSS) | 8.8 | |
| High | CVE-2026-42339 | New API: SSRF Filter Bypass via 0.0.0.0 | 7.1 | |
| High | CVE-2026-25802 | New API has Potential XSS in its MarkdownRenderer component | 7.6 | |
| Medium | CVE-2026-30886 | New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check | 6.5 | |
| Medium | CVE-2026-44342 | New API CSRF in email and WeChat account binding endpoints | 5.3 | |
| Medium | CVE-2026-32879 | New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure | 4.9 |