CVE-2026-22187 | High | 7.8 | 2026-01-07 | Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image proces… |
CVE-2026-22186 | High | 7.1 | 2026-01-07 | Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., X… |
CVE-2025-54791 | Medium | 5.3 | 2025-08-13 | OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgo… |
CVE-2024-35180 | Medium | 6.1 | 2024-05-21 | OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to… |
CVE-2021-41132 | Critical | 9.8 | 2021-10-14 | OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through… |
CVE-2021-21377 | Medium | 4.8 | 2021-03-23 | OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after perfor… |
CVE-2021-21376 | Medium | 6.4 | 2021-03-23 | OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user… |
CVE-2019-16244 | Critical | 9.8 | 2020-07-22 | OMERO.server before 5.6.1 allows attackers to bypass the security filters and access hidden objects via a crafted query. |
CVE-2020-7932 | Medium | 5.7 | 2020-06-17 | OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker tricks a user into… |
CVE-2020-6752 | Low | 3.8 | 2020-06-17 | In OMERO before 5.6.1, group owners can access members' data in other groups. |
CVE-2019-9944 | High | 7.5 | 2020-06-17 | In Open Microscopy Environment OMERO.server 5.0.0 through 5.6.0, the reading of files from imported image filesets may circumvent OMERO permissions restriction… |
CVE-2019-9943 | High | 7.5 | 2020-06-17 | In ome.services.graphs.GraphTraversal.findObjectDetails in Open Microscopy Environment OMERO.server 5.1.0 through 5.6.0, permissions on OMERO model objects may… |
CVE-2019-16245 | Medium | 5.3 | 2020-06-17 | OMERO before 5.6.1 makes the details of each user available to all users. |
CVE-2014-7198 | High | 8.8 | 2019-04-01 | OMERO before 5.0.6 has multiple CSRF vulnerabilities because the framework for OMERO's web interface lacks CSRF protection. |
CVE-2018-1000635 | Medium | 6.7 | 2018-08-20 | The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains a Information Exposure Through Sent Data vulnerability in OMERO.server that can re… |
CVE-2018-1000634 | High | 7.2 | 2018-08-20 | The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains an Improper Access Control vulnerability in User management that can result in adm… |
CVE-2018-1000633 | High | 7.2 | 2018-08-20 | The Open Microscopy Environment OMERO.web version prior to 5.4.7 contains an Information Exposure Through Log Files vulnerability in the login form and change… |
CVE-2017-1000438 | High | 8.3 | 2018-01-02 | In OMERO 5.3.3 or earlier a user could create an OriginalFile and adjust its path such that it now points to another user's file on the underlying filesystem… |