CVE-2026-97288

MEDIUM6.5

Published 2026-09-30 · Updated 2026-09-30 · Source audit@patchstack.com

Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

CWE-79

Same severity, most recent

CVE-2026-103118
A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
2026-09-30 · score 4.3
CVE-2026-97302
Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.
2026-09-30 · score 5.3
CVE-2026-97301
Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.
2026-09-30 · score 6.5
CVE-2026-97299
Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.
2026-09-30 · score 5.4
CVE-2026-97298
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.
2026-09-30 · score 6.5