TR
Product
transformers
31
CVEs
0
On KEV
9.6
Max CVSS
0
New 30D
Severity mix
Critical 2High 20Medium 8Low 1
Watch
Add transformers to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-5241 | 9.6 | Jun 3 | Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers Affected: 5.2.0 |
| CVE-2024-3568 | 9.6 | Apr 10 | Arbitrary Code Execution via Deserialization in huggingface/transformers Affected: before 4.38.0 |
| CVE-2024-11394 | 8.8 | Nov 22 | Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: before 4.48.0 |
| CVE-2024-11393 | 8.8 | Nov 22 | Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: before 4.48.0 |
| CVE-2024-11392 | 8.8 | Nov 22 | Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: before 4.48.0 |
| CVE-2023-6730 | 8.8 | Dec 19 | Deserialization of Untrusted Data in huggingface/transformers Affected: before 4.36.0 |
| CVE-2026-4372 | 7.8 | May 24 | Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers Affected: before 5.3.0 |
| CVE-2026-1839 | 7.8 | Apr 7 | Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers Affected: before 5.0.0; 5.0.0; 5.0.0; 5.0.0 |
| CVE-2025-14930 | 7.8 | Dec 23 | Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: 4.57.1 |
| CVE-2025-14928 | 7.8 | Dec 23 | Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability Affected: 4.57.0 |
| CVE-2025-14924 | 7.8 | Dec 23 | Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: 4.55.0 |
| CVE-2025-14920 | 7.8 | Dec 23 | Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: 4.54.1 |
| CVE-2025-14926 | 7.8 | Dec 23 | Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability Affected: 4.57.0 |
| CVE-2025-14927 | 7.8 | Dec 23 | Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability Affected: 4.57.0 |
| CVE-2025-14921 | 7.8 | Dec 23 | Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: 4.54.1 |
| CVE-2025-14929 | 7.8 | Dec 23 | Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: 5.0.0 |
| CVE-2023-7018 | 7.8 | Dec 20 | Deserialization of Untrusted Data in huggingface/transformers Affected: before 4.36.0 |
| CVE-2025-6921 | 7.5 | Sep 23 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers Affected: before 4.53.0 |
| CVE-2025-6638 | 7.5 | Sep 12 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers Affected: 4.52.4 |
| CVE-2025-3262 | 7.5 | Jul 7 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers Affected: before 4.51.0 |
| CVE-2025-2099 | 7.5 | May 19 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers Affected: through 4.48.3 |
| CVE-2024-12720 | 7.5 | Mar 20 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers Affected: before 4.48.0 |
| CVE-2025-1194 | 6.5 | Apr 29 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers Affected: before 4.50.0 |
| CVE-2026-75104 | 5.5 | Aug 17 | Hugging Face Transformers Path Traversal via Checkpoint Index Affected: through 5.15.0 |
| CVE-2025-6051 | 5.3 | Sep 14 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers Affected: 4.52.4 |
| CVE-2025-5197 | 5.3 | Aug 6 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers Affected: before 4.53.0 |
| CVE-2025-3933 | 5.3 | Jul 11 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers Affected: before 4.52.1 |
| CVE-2025-3264 | 5.3 | Jul 7 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers Affected: 4.49.0 before 4.51.0 |
| CVE-2025-3263 | 5.3 | Jul 7 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers Affected: 4.49.0 before 4.51.0 |
| CVE-2023-2800 | 4.7 | May 18 | Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0 Affected: before 4.30.0 |
| CVE-2025-3777 | 3.5 | Jul 7 | Improper Input Validation in huggingface/transformers Affected: before 4.52.1 |
Showing 31