Openmicroscopy maintains the OMERO image-data management and analysis platform, a specialized tool for microscopy research and biomedical imaging labs that processes and shares sensitive experimental data. Its vulnerability profile centers on the web-accessible OMERO server and web interface, with a durable pattern of exposure including cross-site request forgery, deserialization of untrusted data, and information-disclosure flaws that reflect the challenges of securing web services handling confidential research datasets. A meaningful share of its disclosures reach serious severity; defenders managing OMERO deployments should prioritize patching and restrict access to research-sensitive instances. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Openmicroscopy over time
Signals from CVEs in this vendor scope (18 CVEs).
18 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-16244CRITICAL OMERO.server before 5.6.1 allows attackers to bypass the security filters and access hidden objects via a crafted query. | Jul 22, 2020 | 9.8 | 30 | NO | NO |
CVE-2026-22187HIGH Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. The loci.format | Jan 7, 2026 | 7.8 | 25 | NO | NO |
CVE-2017-1000438HIGH In OMERO 5.3.3 or earlier a user could create an OriginalFile and adjust its path such that it now points to another user's file on the underlying filesystem, then manipulate the u | Jan 2, 2018 | 8.3 | 25 | NO | NO |
CVE-2026-22186HIGH Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF). The parser uses | Jan 7, 2026 | 7.1 | 24 | NO | NO |
CVE-2018-1000634HIGH The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains an Improper Access Control vulnerability in User management that can result in administrative user with | Aug 20, 2018 | 7.2 | 23 | NO | NO |
CVE-2018-1000633HIGH The Open Microscopy Environment OMERO.web version prior to 5.4.7 contains an Information Exposure Through Log Files vulnerability in the login form and change password form that ca | Aug 20, 2018 | 7.2 | 23 | NO | NO |
CVE-2021-41132MEDIUM OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due t | Oct 14, 2021 | 6.1 | 22 | NO | NO |
CVE-2021-21376MEDIUM OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user such as their id, na | Mar 23, 2021 | 6.5 | 22 | NO | NO |
CVE-2014-7198HIGH OMERO before 5.0.6 has multiple CSRF vulnerabilities because the framework for OMERO's web interface lacks CSRF protection. | Apr 1, 2019 | 8.8 | 22 | NO | NO |
CVE-2018-1000635MEDIUM The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains a Information Exposure Through Sent Data vulnerability in OMERO.server that can result in an Attacker g | Aug 20, 2018 | 6.7 | 21 | NO | NO |
Signals from CVEs in this vendor scope (18 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Openmicroscopy.
Media articles that mention a CVE ID that affects a product developed by Openmicroscopy — matched by CVE ID, not by vendor name.