Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2564▼ 303 respecto a la semana anterior
Críticas / altas1351▲ 100 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 7 respecto a la semana anterior
Sin puntuar (sin CVSS)62▼ 466 respecto a la semana anterior
30 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Aplazada | Baja (2.1) | 0.33% | — | Zoneland O2oaAI | 24/9/2026 | 24/9/2026 | A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/x_base_core_project/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the component Cipher Connection Handler. Such manipulation of the argument fileUrl… | |
| Aplazada | Alta (7.8) | 0.19% | — | Zoneland O2oaAI | 17/8/2026 | 9/9/2026 | An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mechanism of the Invoke script execution. | |
| Aplazada | Media (6.1) | 0.26% | — | Zoneland O2oaAI | 4/8/2026 | 9/9/2026 | A reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL. | |
| Aplazada | Baja (2.9) | 0.40% | — | Zoneland O2oaAI | 28/4/2026 | 17/6/2026 | A security vulnerability has been detected in o2oa up to 10.0. This impacts the function syncFile of the file NodeAgent.java of the component NodeAgent. The manipulation leads to improper authorization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is said to be… | |
| Aplazada | Baja (2.1) | 0.35% | — | Zoneland O2oaAI | 28/4/2026 | 17/6/2026 | A weakness has been identified in o2oa up to 10.0. This affects the function FileAction of the file FileAction.java of the component URL Fetching. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available… | |
| Analizada | Baja (2.1) | 0.28% | — | Zoneland O2oa | 7/2/2026 | 17/6/2026 | A vulnerability was identified in O2OA up to 9.0.0. This impacts an unknown function of the file /x_program_center/jaxrs/mpweixin/check of the component HTTP POST Request Handler. The manipulation leads to xml external entity reference. It is possible to initiate the attack remotely. The exploit is publicly available… | |
| Analizada | Baja (2) | 0.34% | — | Zoneland O2oa | 31/8/2025 | 17/6/2026 | A vulnerability was detected in O2OA up to 10.0-410. Affected is an unknown function of the file /x_query_assemble_designer/jaxrs/importmodel of the component Personal Profile Page. Performing manipulation of the argument description/applicationName/queryName results in cross site scripting. Remote exploitation of the… | |
| Analizada | Baja (2) | 0.34% | — | Zoneland O2oa | 31/8/2025 | 17/6/2026 | A security vulnerability has been detected in O2OA up to 10.0-410. This impacts an unknown function of the file /x_query_assemble_designer/jaxrs/statement of the component Personal Profile Page. Such manipulation of the argument description/queryName leads to cross site scripting. The attack may be launched remotely.… | |
| Analizada | Baja (2) | 0.27% | — | Zoneland O2oa | 31/8/2025 | 17/6/2026 | A weakness has been identified in O2OA up to 10.0-410. This affects an unknown function of the file /x_query_assemble_designer/jaxrs/table of the component Personal Profile Page. This manipulation of the argument description/applicationName/queryName causes cross site scripting. The attack may be initiated remotely.… | |
| Analizada | Baja (2) | 0.34% | — | Zoneland O2oa | 31/8/2025 | 17/6/2026 | A security flaw has been discovered in O2OA up to 10.0-410. The impacted element is an unknown function of the file /x_query_assemble_designer/jaxrs/stat of the component Personal Profile Page. The manipulation of the argument name/alias/description/applicationName results in cross site scripting. The attack can be… | |
| Analizada | Baja (2) | 0.27% | — | Zoneland O2oa | 31/8/2025 | 17/6/2026 | A weakness has been identified in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_processplatform_assemble_designer/jaxrs/script of the component Personal Profile Page. Executing manipulation of the argument name/alias/description/applicationName can lead to cross site scripting. The attack… | |
| Analizada | Baja (2) | 0.34% | — | Zoneland O2oa | 31/8/2025 | 17/6/2026 | A security flaw has been discovered in O2OA up to 10.0-410. This affects an unknown part of the file /x_processplatform_assemble_designer/jaxrs/process of the component Personal Profile Page. Performing manipulation of the argument name/alias results in cross site scripting. Remote exploitation of the attack is… | |
| Analizada | Baja (2) | 0.27% | — | Zoneland O2oa | 31/8/2025 | 17/6/2026 | A vulnerability was identified in O2OA up to 10.0-410. Affected by this issue is some unknown functionality of the file /x_organization_assemble_control/jaxrs/unit/ of the component Personal Profile Page. Such manipulation of the argument name/shortName/distinguishedName/pinyin/pinyinInitial/levelName leads to cross… | |
| Analizada | Baja (2) | 0.31% | — | Zoneland O2oa | 31/8/2025 | 17/6/2026 | A vulnerability was determined in O2OA up to 10.0-410. Affected by this vulnerability is an unknown functionality of the file /x_processplatform_assemble_designer/jaxrs/form of the component Personal Profile Page. This manipulation of the argument name/alias/description causes cross site scripting. The attack may be… | |
| Analizada | Baja (2) | 0.33% | — | Zoneland O2oa | 31/8/2025 | 17/6/2026 | A vulnerability was found in O2OA up to 10.0-410. Affected is an unknown function of the file /x_cms_assemble_control/jaxrs/script of the component Personal Profile Page. The manipulation of the argument name/alias/description results in cross site scripting. The attack can be launched remotely. The exploit has been… | |
| Analizada | Baja (2) | 0.33% | — | Zoneland O2oa | 30/8/2025 | 17/6/2026 | A vulnerability was found in O2OA up to 10.0-410. Affected by this issue is some unknown functionality of the file /x_cms_assemble_control/jaxrs/form of the component Personal Profile Page. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could… | |
| Analizada | Baja (2) | 0.33% | — | Zoneland O2oa | 30/8/2025 | 17/6/2026 | A vulnerability has been found in O2OA up to 10.0-410. Affected by this vulnerability is an unknown functionality of the file /x_cms_assemble_control/jaxrs/design/appdict of the component Personal Profile Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been… | |
| Analizada | Baja (2) | 0.33% | — | Zoneland O2oa | 30/8/2025 | 17/6/2026 | A flaw has been found in O2OA up to 10.0-410. Affected is an unknown function of the file /x_program_center/jaxrs/agent of the component Personal Profile Page. Executing manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been published and may be used. The vendor… | |
| Analizada | Baja (2) | 0.41% | — | Zoneland O2oa | 30/8/2025 | 17/6/2026 | A vulnerability was detected in O2OA up to 10.0-410. This impacts an unknown function of the file /x_portal_assemble_designer/jaxrs/page of the component Personal Profile Page. Performing manipulation results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. The… | |
| Analizada | Baja (2) | 0.27% | — | Zoneland O2oa | 29/8/2025 | 17/6/2026 | A vulnerability has been found in O2OA up to 10.0-410. The affected element is an unknown function of the file /x_portal_assemble_designer/jaxrs/widget of the component Personal Profile Page. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the… | |
| Analizada | Baja (2) | 0.27% | — | Zoneland O2oa | 29/8/2025 | 17/6/2026 | A flaw has been found in O2OA up to 10.0-410. Impacted is an unknown function of the file /x_portal_assemble_designer/jaxrs/dict/ of the component Personal Profile Page. This manipulation of the argument name/alias/description causes cross site scripting. Remote exploitation of the attack is possible. The exploit has… | |
| Analizada | Baja (2) | 0.27% | — | Zoneland O2oa | 29/8/2025 | 17/6/2026 | A vulnerability was detected in O2OA up to 10.0-410. This issue affects some unknown processing of the file /x_program_center/jaxrs/script of the component Personal Profile Page. The manipulation of the argument name/alias/description results in cross site scripting. The attack may be launched remotely. The exploit is… | |
| Analizada | Media (5.1) | 0.27% | — | Zoneland O2oa | 29/8/2025 | 17/6/2026 | A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /x_organization_assemble_control/jaxrs/person/ of the component Personal Profile Page. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be launched remotely. The vendor… | |
| Analizada | Baja (2) | 0.27% | — | Zoneland O2oa | 29/8/2025 | 17/6/2026 | A security flaw has been discovered in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_organization_assemble_personal/jaxrs/definition/calendarConfig. The manipulation of the argument toMonthViewName results in cross site scripting. The attack can be launched remotely. The exploit has been… | |
| Analizada | Alta (8.8) | 0.52% | — | Zoneland O2oa | 27/8/2025 | 17/6/2026 | O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function. |