ome vulnerabilities

Products

• omero-web 5
• ome/pom-bio-formats 2

Latest ome CVEs

Newest publication first

1. CVE-2026-22187 Bio-Formats <= 8.3.0 Memoizer Unsafe Deserialization via .bfmemo Cache Files

   Published 2026-01-07

   Medium·CVSS 6.8 EPSS 0.51%

   Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. The loci.formats.Memoizer class automatically loads and deserializes memo files associated with images without vali...

2. CVE-2026-22186 Bio-Formats <= 8.3.0 XXE in Leica XLEF Metadata Parser

   Published 2026-01-07

   Medium·CVSS 4.6 EPSS 0.17%

   Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF). The parser uses an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files, all...

3. CVE-2025-54791 OMERO.web displays unecessary user information when requesting to reset the password

   Published 2025-08-13

   Medium·CVSS 5.3 EPSS 0.28%

   OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. This...

4. CVE-2024-35180 OMERO.web JSONP callback vulnerability

   Published 2024-05-21

   Medium·CVSS 6.1 EPSS 0.29%

   OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the callback parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.

5. CVE-2021-41132 Inconsistent input sanitisation leads to XSS vectors

   Published 2021-10-14

   Medium·CVSS 6.1 EPSS 1.0%

   OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of jQuery.html(), there are a whole host of cross-site scripting...

6. CVE-2021-21377 Open Redirect in OMERO.web

   Published 2021-03-23

   Medium·CVSS 5.4 EPSS 0.83%

   OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.w...

7. CVE-2021-21376 Information Exposure in OMERO.web

   Published 2021-03-23

   Medium·CVSS 6.5 EPSS 1.5%

   OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. This represents...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.