Project-MONAI MONAI vulnerabilities

CVEs per yearBy the year they were published

1. 20253
2. 202614

Newest CVEs

• CVE-2026-48705

  MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)

  Project-MONAI · MONAI

  Critical9.3
• CVE-2026-119578

  MONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()

  Project-MONAI · MONAI

  High8.5
• CVE-2026-118684

  MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads

  Project-MONAI · MONAI

  High8.2
• CVE-2026-118683

  MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf

  Project-MONAI · MONAI

  High8.6
• CVE-2026-109361

  MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path

  Project-MONAI · MONAI

  High7.0
• CVE-2026-109360

  MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP

  Project-MONAI · MONAI

  High7.7
• CVE-2026-100846

  MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization

  Project-MONAI · MONAI

  High8.8
• CVE-2026-100845

  MONAI before 1.6.0 Remote Code Execution via NumpyReader

  Project-MONAI · MONAI

  High8.5
• CVE-2026-100844

  MONAI before 1.6.0 OS Command Injection via dataset_name_or_id

  Project-MONAI · MONAI

  High8.6
• CVE-2026-100843

  MONAI before 1.6.0 Remote Code Execution via algo_from_pickle

  Project-MONAI · MONAI

  High8.5