EUVD-2026-57807

Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a...

CVE-2026-73603

Flowise before 3.1.4 exposes an unauthenticated text-to-speech endpoint that does not validate chatflow visibility, allowing unauthenticated attackers to abuse private chatflow TTS credentials and generate unlimited TTS audio using stored OpenAI or ElevenLabs keys by providing a valid chatflow UU...

CVE-2026-15241

The CVE-2026-15241 affects the AI ChatBot for WooCommerce WordPress plugin prior to 4.8.4. It lacks authorization/nonce checks on an AJAX action, enabling unauthenticated users to abuse the site owner’s stored third‑party API key to send requests billed to the owner and, if enabled, retrieve inde...

Use of a Key Past its Expiration Date

Overview Affected versions of this package are vulnerable to Use of a Key Past its Expiration Date due to improper enforcement of OIDC token expiry in the authentication process when no refresh token is provided. An attacker can maintain unauthorized access to the service by continuously using a...

Improper Access Control in bramp/myip

✍️ Description Google Maps API key is enabled without proper referer restrictions is found in your repo. It can be embeded to anyone's website and if the billing account is active, it will incur charges on your account. If Google Maps is not used in your project, then all the following APIs should...