Openmicroscopy

By the Year

In 2026 there have been 2 vulnerabilities in Openmicroscopy. Last year, in 2025 Openmicroscopy had 1 security vulnerability published. That is, 1 more vulnerability have already been reported in 2026 as compared to last year.

Recent Openmicroscopy Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-22187	Jan 07, 2026	Bio-Formats 8.3.0 Unsafe Java Deserialization via .bfmemo Cache Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. The loci.formats.Memoizer class automatically loads and deserializes memo files associated with images without validation, integrity checks, or trust enforcement. An attacker who can supply a crafted .bfmemo file alongside an image can trigger deserialization of untrusted data, which may result in denial of service, logic manipulation, or potentially remote code execution in environments where suitable gadget chains are present on the classpath.	Bio Formats
CVE-2026-22186	Jan 07, 2026	Bio-Formats 8.3.0 XXE in Leica Metadata Parser Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF). The parser uses an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files, allowing external entity expansion and external DTD loading. A crafted metadata file can trigger outbound network requests (SSRF), access local system resources where readable, or cause a denial of service during XML parsing.	Bio Formats
CVE-2025-54791	Aug 13, 2025	OMERO.web info disclosure via Forgot Password before 5.29.2 OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. This issue has been patched in version 5.29.2. A workaround involves disabling the Forgot password option in OMERO.web using the omero.web.show_forgot_password configuration property.	Omero Web
CVE-2021-41132	Oct 14, 2021	OMERO.web provides a web based client and plugin infrastructure OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.	Omero Figure Omero Web
CVE-2021-21376	Mar 23, 2021	OMERO.web is open source Django-based software for managing microscopy imaging OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. This represents an information exposure vulnerability. Some additional information being loaded is not used by the webclient and is being removed in this release. This is fixed in version 5.9.0.	Omero Web
CVE-2021-21377	Mar 23, 2021	OMERO.web is open source Django-based software for managing microscopy imaging OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the omero.web.redirect_allowed_hosts setting.	Omero Web
CVE-2020-6752	Jun 17, 2020	In OMERO before 5.6.1, group owners In OMERO before 5.6.1, group owners can access members' data in other groups.	Omero
CVE-2019-16245	Jun 17, 2020	OMERO before 5.6.1 makes the details of each user available to all users. OMERO before 5.6.1 makes the details of each user available to all users.	Omero
CVE-2018-1000633	Aug 20, 2018	The Open Microscopy Environment OMERO.web version prior to 5.4.7 contains an Information Exposure Through Log Files vulnerability in the login form and change password form The Open Microscopy Environment OMERO.web version prior to 5.4.7 contains an Information Exposure Through Log Files vulnerability in the login form and change password form that can result in User's password being revealed. Attacker can log in as that user. This attack appear to be exploitable via an attacker reading the web server log. This vulnerability appears to have been fixed in 5.4.7.	Omero
CVE-2018-1000634	Aug 20, 2018	The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains an Improper Access Control vulnerability in User management The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains an Improper Access Control vulnerability in User management that can result in administrative user with privilege restrictions logging in as a more powerful administrator. This attack appear to be exploitable via Use user administration privilege to set the password of a more powerful administrator. This vulnerability appears to have been fixed in 5.4.7.	Omero