Project-MONAI MONAI

• CVE-2026-48705 Critical 9.3 MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) 0.5%
• CVE-2026-119578 High 7.8 MONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json() 0.6%
• CVE-2026-118684 Medium 5.9 MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads 0.2%
• CVE-2026-118683 High 8.8 MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf 0.5%
• CVE-2026-109361 High 7.3 MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path 0.2%
• CVE-2026-109360 High 7.5 MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP 0.6%
• CVE-2026-100846 High 7.6 MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization 0.4%
• CVE-2026-100845 High 7.8 MONAI before 1.6.0 Remote Code Execution via NumpyReader 0.2%
• CVE-2026-100844 High 8.4 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id 0.9%
• CVE-2026-100843 High 7.8 MONAI before 1.6.0 Remote Code Execution via algo_from_pickle 0.3%
• CVE-2026-100842 High 7.0 MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains 0.2%
• CVE-2026-100841 High 7.8 MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache 0.1%
• CVE-2026-100840 High 7.8 MONAI through 1.6.0 Remote Code Execution via bundle configuration 0.3%
• CVE-2026-21851 Medium 5.3 MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download 0.4%
• CVE-2025-58757 High 8.8 MONAI's unsafe use of Pickle deserialization may lead to RCE 0.6%
• CVE-2025-58756 High 8.8 MONAI's unsafe torch usage may lead to arbitrary code execution 0.8%
• CVE-2025-58755 High 8.8 MONAI has path traversal issue that may lead to arbitrary file writes 0.6%