[ Vendor · 9 CVEs ]
Project-MONAI
CVEs affecting Project-MONAI published in the last 30 days, plus any Project-MONAI CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-109360 | 12 Oct 2026 | CVSS 7.5 | Project-MONAI MONAIMONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet… | |
| CVE-2026-109361 | 12 Oct 2026 | CVSS 7.3 | Project-MONAI MONAIMONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from… | |
| CVE-2026-100845 | 27 Sep 2026 | CVSS 7.8 | Project-MONAI MONAIMONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with… | |
| CVE-2026-100846 | 27 Sep 2026 | CVSS 8.8 | Project-MONAI MONAIMONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The… | |
| CVE-2026-100840 | 27 Sep 2026 | CVSS 7.8 | Project-MONAI MONAIMONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary… | |
| CVE-2026-100841 | 27 Sep 2026 | CVSS 7.8 | Project-MONAI MONAIIn MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users… | |
| CVE-2026-100842 | 27 Sep 2026 | CVSS 8.8 | Project-MONAI MONAIMONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape… | |
| CVE-2026-100843 | 27 Sep 2026 | CVSS 7.8 | Project-MONAI MONAIMONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads()… | |
| CVE-2026-100844 | 27 Sep 2026 | CVSS 7.8 | Project-MONAI MONAIMONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values… |