Project-monai - vulnerabilities (CVEs)
15 CVEs in 1 products, 4 in the last 30 days, newest from 2026-10-28.
Products
- Monai - 12 CVEs
Newest CVEs of Project-monai
- CVE-2026-118684 - CVSS 8.2 (high), 2026-10-28: MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as…
- CVE-2026-118683 - CVSS 8.8 (high), 2026-10-28: MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a bundle's configs/logging.conf to…
- CVE-2026-109361 - CVSS 7.3 (high), 2026-10-12: MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from…
- CVE-2026-109360 - CVSS 7.7 (high), 2026-10-12: MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained…
- CVE-2026-100846 - CVSS 8.8 (high), 2026-09-27: MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads…
- CVE-2026-100845 - CVSS 8.5 (high), 2026-09-27: MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when…
- CVE-2026-100844 - CVSS 8.6 (high), 2026-09-27: MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken…
- CVE-2026-100842 - CVSS 8.8 (high), 2026-09-27: MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions…
- CVE-2026-100843 - CVSS 8.5 (high), 2026-09-27: MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in…
- CVE-2026-100841 - CVSS 8.5 (high), 2026-09-27: In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache…
- CVE-2026-100840 - CVSS 8.5 (high), 2026-09-27: MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable…
- CVE-2026-21851 - CVSS 5.3 (medium), 2026-01-07: MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.1, a Path Traversal (Zip Slip) vulnerability…
- CVE-2025-58757 - CVSS 8.8 (high), 2025-09-09: MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the `pickle_operations` function in…
- CVE-2025-58756 - CVSS 8.8 (high), 2025-09-09: MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.0, in `model_dict = torch.load(full_path,…
- CVE-2025-58755 - CVSS 8.8 (high), 2025-09-09: MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. The extractall function `zip_file.extractall(output_dir)` is used directly to…
