Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Project-MONAI MONAI 1.6.0 Clear all filters
TI-2026-64983 CVE-2026-100845 · GHSA-4jj3-3266-2688

MONAI before 1.6.0 Remote Code Execution via NumpyReader

Priority HIGH 72

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when loading .npy and .npz files.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00203 Published 2026-09-27 Fixed in 1.6.0 CWE-502
TI-2026-64981 CVE-2026-100843 · GHSA-m8hq-fmc4-c3v2

MONAI before 1.6.0 Remote Code Execution via algo_from_pickle

Priority HIGH 72

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in monai/auto3dseg/utils.py.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00305 Published 2026-09-27 Fixed in 1.6.0 CWE-502