https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T13:59:32.104834+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-31489 EUVD-2026-31489 2026-10-04T13:59:32.108543+00:00 EUVD-2026-31489 https://cve.radiocsirt.org/vuln/fkie_cve-2021-41132 fkie_cve-2021-41132 2026-10-04T13:59:32.108574+00:00

OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.

 https://cve.radiocsirt.org/vuln/ghsa-g67g-hvc3-xmvf GHSA-g67g-hvc3-xmvf — Inconsistent input sanitisation leads to XSS vectors 2026-10-04T13:59:32.108607+00:00

Affected: PyPI: omero-web, PyPI: omero-figure

### Background

A variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of XSS possibilities with specially crafted input to a variety of fields.

### Impact

OMERO.web before 5.11.0 and OMERO.figure before 4.4.1.

### Patches Users should upgrade OMERO.web to 5.11.0 or higher and OMERO.figure to 4.4.1 or higher.

 https://cve.radiocsirt.org/vuln/gsd-2021-41132 gsd-2021-41132 2026-10-04T13:59:32.108636+00:00 gsd-2021-41132 https://cve.radiocsirt.org/vuln/pysec-2021-372 PYSEC-2021-372 2026-10-04T13:59:32.108649+00:00

Affected: PyPI: omero-web

OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.