CVE-2024-35180: Openmicroscopy Omero-Web

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.

Affected products

• Openmicroscopy Omero-Web: before 5.26.0 (fixed in 5.26.0)

Published 2024-05-21. Last modified 2026-06-17.