https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T08:53:06.271283+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-64865 CVE-2026-64865 — New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass 2026-10-09T08:53:06.288812+00:00

Affected: QuantumNous new-api

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high. This issue is fixed in version 1.0.0-rc.16.