{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"8.3.0"}],"component":"ome:pom-bio-formats","cve_ids":["CVE-2026-22186"],"ecosystem":"Maven","epss":0.00173,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-fcqj-76g3-q7qm","id":"tcs_01M5N8VS3K26E9B5KJA3GN5HVD","modified_at":"2026-04-02T13:26:22.436752571Z","published_at":"2026-01-07T21:31:56Z","references":["https://osv.dev/vulnerability/GHSA-fcqj-76g3-q7qm","https://github.com/ome/bioformats/security/advisories/GHSA-x9vc-qh97-8gjp","https://nvd.nist.gov/vuln/detail/CVE-2026-22186","https://docs.openmicroscopy.org/bio-formats","https://github.com/ome/bioformats","https://seclists.org/fulldisclosure/2026/Jan/6","https://www.vulncheck.com/advisories/bio-formats-xxe-in-leica-xlef-metadata-parser"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-fcqj-76g3-q7qm","url":"https://osv.dev/vulnerability/GHSA-fcqj-76g3-q7qm"}],"summary":"Bio-Formats has an XML External Entity (XXE) vulnerability"}