Vulnerabilities in Project-MONAI
17 resultsCVE-2026-100844HIGHMONAI before 1.6.0 OS Command Injection via dataset_name_or_idEPSS 0.9%CVE-2025-58756HIGHMONAI's unsafe torch usage may lead to arbitrary code executionEPSS 0.8%CVE-2025-58757HIGHMONAI's unsafe use of Pickle deserialization may lead to RCEEPSS 0.6%CVE-2025-58755HIGHMONAI has path traversal issue that may lead to arbitrary file writesEPSS 0.6%CVE-2026-109360HIGHMONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTPEPSS 0.6%CVE-2026-119578HIGHMONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()EPSS 0.6%CVE-2026-48705CRITICALMONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)EPSS 0.5%CVE-2026-118683HIGHMONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.confEPSS 0.5%CVE-2026-100846HIGHMONAI before 1.5.2 Remote Code Execution via Pickle DeserializationEPSS 0.4%CVE-2026-21851MEDIUMMONAI has Path Traversal (Zip Slip) in NGC Private Bundle DownloadEPSS 0.4%CVE-2026-100840HIGHMONAI through 1.6.0 Remote Code Execution via bundle configurationEPSS 0.3%CVE-2026-100843HIGHMONAI before 1.6.0 Remote Code Execution via algo_from_pickleEPSS 0.3%CVE-2026-109361HIGHMONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file PathEPSS 0.2%CVE-2026-100845HIGHMONAI before 1.6.0 Remote Code Execution via NumpyReaderEPSS 0.2%CVE-2026-118684HIGHMONAI before 1.6.1 Missing Integrity Verification via check_hash in DownloadsEPSS 0.2%CVE-2026-100842HIGHMONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute ChainsEPSS 0.2%CVE-2026-100841HIGHMONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle CacheEPSS 0.1%