2201049 matches found
CVE-2026-100850
AzuraCast versions prior to 0.23.8 are vulnerable to Server-Side Request Forgery (SSRF) and Local File Read within the AutoDJ remote playlist fetch function (backend/src/Radio/AutoDJ/QueueBuilder.php). The root cause is the application's failure to validate the remote_url parameter, allowing user...
CVE-2026-100850 AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist
AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch backend/src/Radio/AutoDJ/QueueBuilder.php, getMediaFromRemoteUrl. A user with the station Media permission can create or update a playlist with source=remoteurl and...
EUVD-2026-87838
AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch backend/src/Radio/AutoDJ/QueueBuilder.php, getMediaFromRemoteUrl. A user with the station Media permission can create or update a playlist with source=remoteurl and...
EUVD-2026-87842
MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algofrompickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algofrompickle ...
CVE-2026-100846
The MONAI library, in versions prior to 1.5.2 , is vulnerable to Remote Code Execution (RCE) due to an insecure deserialization of untrusted data. The flaw exists within the algo_from_pickle function located in monai/auto3dseg/utils.py , which processes .pkl files and passes their contents to pic...
CVE-2026-100846 MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization
MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algofrompickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algofrompickle ...
CVE-2026-100846 MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization
MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algofrompickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algofrompickle ...
CVE-2026-100844 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...
EUVD-2026-87844
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...
CVE-2026-100844 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...
CVE-2026-100844 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...
CVE-2026-100844
MONAI versions prior to 1.6.0 are vulnerable to an OS command injection flaw within the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). The root cause is the insecure concatenation of user-controlled values from YAML configuration files (specifically dataset_name_or_id) and CLI/kwar...
EUVD-2026-87847
In MONAI 1.6.0, PersistentDataset monai/data/dataset.py explicitly rejects the combination trackmeta=True with weightsonly=True, forcing users who cache MetaTensors the default tensor type in MONAI = 1.0 to run torch.loadhashfile, weightsonly=False. Related cache helpers in monai/data/utils.py al...
CVE-2026-100841 MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache
In MONAI 1.6.0, PersistentDataset monai/data/dataset.py explicitly rejects the combination trackmeta=True with weightsonly=True, forcing users who cache MetaTensors the default tensor type in MONAI = 1.0 to run torch.loadhashfile, weightsonly=False. Related cache helpers in monai/data/utils.py al...
CVE-2026-100841
The monai pip package (all released versions) contains a Remote Code Execution (RCE) vulnerability in the PersistentDataset component (specifically monai/data/dataset.py). The root cause is the deserialization of malicious pickle files from a shared or world-writable cache_dir (e.g., /tmp/monai_c...
CVE-2026-100841 MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache
In MONAI 1.6.0, PersistentDataset monai/data/dataset.py explicitly rejects the combination trackmeta=True with weightsonly=True, forcing users who cache MetaTensors the default tensor type in MONAI = 1.0 to run torch.loadhashfile, weightsonly=False. Related cache helpers in monai/data/utils.py al...
CVE-2026-100841 MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache
In MONAI 1.6.0, PersistentDataset monai/data/dataset.py explicitly rejects the combination trackmeta=True with weightsonly=True, forcing users who cache MetaTensors the default tensor type in MONAI = 1.0 to run torch.loadhashfile, weightsonly=False. Related cache helpers in monai/data/utils.py al...
CVE-2025-71424 Edgeless Systems Contrast before 1.9.1 Insecure Volume Mount
Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...
CVE-2025-71424 Edgeless Systems Contrast before 1.9.1 Insecure Volume Mount
Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...
EUVD-2025-211008
Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...