MO
Product
MONAI
15
CVEs
0
On KEV
8.8
Max CVSS
4
New 30D
Severity mix
Critical 0High 13Medium 2Low 0
Watch
Add MONAI to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-118683 New | 8.8 | Oct 28 | MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf Affected: 1.2.0 before 1.6.1 |
| CVE-2026-100846 | 8.8 | Sep 27 | MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization Affected: before 1.5.2 |
| CVE-2026-100842 | 8.8 | Sep 27 | MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains Affected: through 1.6.0 |
| CVE-2025-58757 | 8.8 | Sep 8 | MONAI's unsafe use of Pickle deserialization may lead to RCE Affected: <= 1.5.0 |
| CVE-2025-58756 | 8.8 | Sep 8 | MONAI's unsafe torch usage may lead to arbitrary code execution Affected: <= 1.5.0 |
| CVE-2025-58755 | 8.8 | Sep 8 | MONAI has path traversal issue that may lead to arbitrary file writes Affected: <= 1.5.0 |
| CVE-2026-100845 | 7.8 | Sep 27 | MONAI before 1.6.0 Remote Code Execution via NumpyReader Affected: before 1.6.0 |
| CVE-2026-100844 | 7.8 | Sep 27 | MONAI before 1.6.0 OS Command Injection via dataset_name_or_id Affected: before 1.6.0 |
| CVE-2026-100843 | 7.8 | Sep 27 | MONAI before 1.6.0 Remote Code Execution via algo_from_pickle Affected: before 1.6.0 |
| CVE-2026-100841 | 7.8 | Sep 27 | MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache Affected: through 1.6.0 |
| CVE-2026-100840 | 7.8 | Sep 27 | MONAI through 1.6.0 Remote Code Execution via bundle configuration Affected: through 1.6.0 |
| CVE-2026-109360 | 7.5 | Oct 12 | MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP Affected: 0.4.0 before 1.6.1 |
| CVE-2026-109361 | 7.3 | Oct 12 | MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path Affected: 1.2.0 before 1.6.1 |
Showing 13