Project-monai vulnerabilities

Products

• Monai 17

Newest

• project-monai monai MONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json() CVE-2026-119578 8.5 HighOctober 30, 2026
• project-monai monai MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads CVE-2026-118684 8.2 HighOctober 28, 2026
• project-monai monai MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf CVE-2026-118683 8.6 HighOctober 28, 2026
• project-monai monai MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) CVE-2026-48705 Fix available 9.3 CriticalOctober 27, 2026
• project-monai monai MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path CVE-2026-109361 7.0 HighOctober 12, 2026
• project-monai monai MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP CVE-2026-109360 7.7 HighOctober 12, 2026
• project-monai monai MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains CVE-2026-100842 Fix available 7.3 HighSeptember 27, 2026
• project-monai monai MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache CVE-2026-100841 8.5 HighSeptember 27, 2026
• project-monai monai MONAI through 1.6.0 Remote Code Execution via bundle configuration CVE-2026-100840 Fix available 8.5 HighSeptember 27, 2026
• project-monai monai MONAI before 1.6.0 Remote Code Execution via NumpyReader CVE-2026-100845 Fix available 8.5 HighAugust 18, 2026
• project-monai monai MONAI before 1.6.0 OS Command Injection via dataset_name_or_id CVE-2026-100844 Fix available 8.6 HighAugust 18, 2026
• project-monai monai MONAI before 1.6.0 Remote Code Execution via algo_from_pickle CVE-2026-100843 Fix available 8.5 HighAugust 18, 2026
• project-monai monai MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization CVE-2026-100846 Fix available 8.8 HighApril 7, 2026
• project-monai monai MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download CVE-2026-21851 Fix available 5.3 MediumJanuary 6, 2026
• monai medical open network for ai, project-monai monai +1 more MONAI's unsafe use of Pickle deserialization may lead to RCE CVE-2025-58757 Fix available 8.8 HighSeptember 8, 2025
• monai medical open network for ai, project-monai monai +1 more MONAI's unsafe torch usage may lead to arbitrary code execution CVE-2025-58756 Fix available 8.8 HighSeptember 8, 2025
• monai medical open network for ai, project-monai monai +1 more MONAI has path traversal issue that may lead to arbitrary file writes CVE-2025-58755 Fix available 8.8 HighSeptember 8, 2025