High
CVE-2026-100846
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 11
Reset filters
High
CVE-2026-100845
MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files
High
CVE-2026-100842
MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only
High
CVE-2026-100843
Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch
Unrated
CVE-2026-100841
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MON
High
CVE-2026-100844
MONAI vulnerable to OS command injection
Unrated
CVE-2026-100840
MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable callables without an allow list and passes $
Medium
CVE-2026-21851
MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download
High
CVE-2025-58757
Monai: Unsafe use of Pickle deserialization may lead to RCE
High
CVE-2025-58756
MONAI: Unsafe torch usage may lead to arbitrary code execution
High
CVE-2025-58755
MONAI does not prevent path traversal, potentially leading to arbitrary file writes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.