PR
Vendor
Project-MONAI
15
CVEs
0
On KEV
4
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118684 New | MO MONAI Project-MONAI | 5.9 | Oct 28 | MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads |
| CVE-2026-118683 New | MO MONAI Project-MONAI | 8.8 | Oct 28 | MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf |
| CVE-2026-109361 | MO MONAI Project-MONAI | 7.3 | Oct 12 | MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path |
| CVE-2026-109360 | MO MONAI Project-MONAI | 7.5 | Oct 12 | MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP |
| CVE-2026-100846 | MO MONAI Project-MONAI | 8.8 | Sep 27 | MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization |
| CVE-2026-100845 | MO MONAI Project-MONAI | 7.8 | Sep 27 | MONAI before 1.6.0 Remote Code Execution via NumpyReader |
| CVE-2026-100844 | MO MONAI Project-MONAI | 7.8 | Sep 27 | MONAI before 1.6.0 OS Command Injection via dataset_name_or_id |
| CVE-2026-100843 | MO MONAI Project-MONAI | 7.8 | Sep 27 | MONAI before 1.6.0 Remote Code Execution via algo_from_pickle |
| CVE-2026-100842 | MO MONAI Project-MONAI | 8.8 | Sep 27 | MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains |
| CVE-2026-100841 | MO MONAI Project-MONAI | 7.8 | Sep 27 | MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache |
| CVE-2026-100840 | MO MONAI Project-MONAI | 7.8 | Sep 27 | MONAI through 1.6.0 Remote Code Execution via bundle configuration |
| CVE-2026-21851 | MO MONAI Project-MONAI | 5.3 | Jan 7 | MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download |
| CVE-2025-58757 | MO MONAI Project-MONAI | 8.8 | Sep 8 | MONAI's unsafe use of Pickle deserialization may lead to RCE |
| CVE-2025-58756 | MO MONAI Project-MONAI | 8.8 | Sep 8 | MONAI's unsafe torch usage may lead to arbitrary code execution |
| CVE-2025-58755 | MO MONAI Project-MONAI | 8.8 | Sep 8 | MONAI has path traversal issue that may lead to arbitrary file writes |