https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-22187.htmlhttps://patchthecve.com/cve/CVE-2026-22187.htmlThu, 08 Oct 2026 16:17:11 +0000HIGH 7.8: Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. The loci.formats.Memoizer class automatically loads and deserializes memo files associated with images without validation, integrity chhttps://patchthecve.com/cve/CVE-2026-22186.htmlhttps://patchthecve.com/cve/CVE-2026-22186.htmlThu, 08 Oct 2026 16:17:10 +0000HIGH 7.1: Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF). The parser uses an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files, allowing external entithttps://patchthecve.com/cve/CVE-2025-54791.htmlhttps://patchthecve.com/cve/CVE-2025-54791.htmlWed, 17 Jun 2026 09:40:42 +0000MEDIUM 5.3: OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. This issue has been patchttps://patchthecve.com/cve/CVE-2024-35180.htmlhttps://patchthecve.com/cve/CVE-2024-35180.htmlWed, 17 Jun 2026 07:34:29 +0000MEDIUM 6.1: OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.