CVE-2026-2074
Medium · 6.3CVSS
6.3
EPSS
0.3%
Published
Feb 7, 2026
CISA due date
—
The record
A vulnerability was identified in O2OA up to 9.0.0. This impacts an unknown function of the file /x_program_center/jaxrs/mpweixin/check of the component HTTP POST Request Handler. The manipulation leads to xml external entity reference. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119342 Stirling-PDF is a locally hosted web application that facilitates various operations on… CWE-610
- CVE-2026-67077 HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could… CWE-610
- CVE-2026-19032 jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI… CWE-610
- CVE-2026-21810 HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference… CWE-610
- CVE-2026-79256 Externally controlled reference in WebView in Google Chrome on on Android prior to… CWE-610
- CVE-2026-78966 Externally controlled reference in QUIC in Google Chrome prior to 152.0.7977.65 allowed a… CWE-610
- CVE-2026-76572 A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. CWE-610
- CVE-2026-68562 A flaw was found in ansible-collection-redhat-leapp. CWE-610