Project-MONAI MONAI vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Latest Project-MONAI MONAI vulnerabilities

CVE-2026-119578 — MONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json() (CVSS 7.8)
CVE-2026-118684 — MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads (CVSS 5.9)
CVE-2026-118683 — MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf (CVSS 8.8)
CVE-2026-109361 — MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path (CVSS 7.3)
CVE-2026-109360 — MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP (CVSS 7.5)
CVE-2026-100846 — MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization (CVSS 8.8)
CVE-2026-100845 — MONAI before 1.6.0 Remote Code Execution via NumpyReader (CVSS 7.8)
CVE-2026-100844 — MONAI before 1.6.0 OS Command Injection via dataset_name_or_id (CVSS 7.8)
CVE-2026-100843 — MONAI before 1.6.0 Remote Code Execution via algo_from_pickle (CVSS 7.8)
CVE-2026-100842 — MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains (CVSS 8.8)
CVE-2026-100841 — MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache (CVSS 7.8)
CVE-2026-100840 — MONAI through 1.6.0 Remote Code Execution via bundle configuration (CVSS 7.8)
CVE-2026-21851 — MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download (CVSS 5.3)