CVE-2026-15241

The CVE-2026-15241 entry concerns the AI ChatBot for WooCommerce WordPress plugin (pre-4.8.4). The flaw is a missing authorization/nonce check on an AJAX action, allowing unauthenticated users to misuse the site owner’s stored third-party API key to send requests billed to the owner’s account, an...

Use of a Key Past its Expiration Date

Overview Affected versions of this package are vulnerable to Use of a Key Past its Expiration Date due to improper enforcement of OIDC token expiry in the authentication process when no refresh token is provided. An attacker can maintain unauthorized access to the service by continuously using a...

Improper Access Control in bramp/myip

✍️ Description Google Maps API key is enabled without proper referer restrictions is found in your repo. It can be embeded to anyone's website and if the billing account is active, it will incur charges on your account. If Google Maps is not used in your project, then all the following APIs should...