https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T10:55:13.627262+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-64868 CVE-2026-64868 — New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging 2026-10-06T10:55:13.643841+00:00

Affected: QuantumNous new-api

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the payment controllers, allowing an unauthenticated attacker to cause memory pressure, container restarts, or disk exhaustion without forging a successful payment. This issue is fixed in version 1.0.0-rc.11.