HU
Vendor
huggingface
70
CVEs
0
On KEV
1
New 30D
Products
DA8.8
datasets
huggingface
3 CVEs0 on KEV1 new
TR9.6
transformers
huggingface
31 CVEs0 on KEV0 new
HU9.6
huggingface/transformers
huggingface
17 CVEs0 on KEV0 new
DI8.8
diffusers
huggingface
4 CVEs0 on KEV0 new
SM10.0
smolagents
huggingface
4 CVEs0 on KEV0 new
HU10.0
huggingface/smolagents
huggingface
2 CVEs0 on KEV0 new
HU7.5
huggingface/text-generation-inference
huggingface
2 CVEs0 on KEV0 new
LE9.8
LeRobot
huggingface
2 CVEs0 on KEV0 new
TE8.6
text-generation-inference
huggingface
2 CVEs0 on KEV0 new
AC7.1
accelerate
huggingface
1 CVEs0 on KEV0 new
PE8.8
peft
huggingface
1 CVEs0 on KEV0 new
TO6.5
tokenizers
huggingface
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-57845 New | DA datasets huggingface | 8.8 | Oct 23 | Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder |
| CVE-2026-85670 | TO tokenizers huggingface | 6.5 | Sep 4 | tokenizers BpeBuilder Buffer Overflow via merge token |
| CVE-2026-75104 | TR transformers huggingface | 5.5 | Aug 17 | Hugging Face Transformers Path Traversal via Checkpoint Index |
| CVE-2026-69112 | AC accelerate huggingface | 7.1 | Aug 10 | Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map |
| CVE-2026-71281 | PE peft huggingface | 8.8 | Aug 5 | peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules |
| CVE-2026-9856 | HU huggingface/transformers huggingface | 7.1 | Aug 2 | Path Traversal in huggingface/transformers |
| CVE-2026-66007 | DA datasets huggingface | 6.5 | Jul 24 | Datasets Path Traversal via Unsanitized file_name Metadata |
| CVE-2026-65010 | DA datasets huggingface | 6.6 | Jul 23 | Datasets Symlink-following Arbitrary File Write via Extractor.extract() |
| CVE-2026-65920 | DI diffusers huggingface | 4.3 | Jul 23 | Diffusers Path Traversal via weight_map Arbitrary File Read |
| CVE-2026-63086 | TE text-generation-inference huggingface | 8.6 | Jul 16 | text-generation-inference 3.3.7 SSRF via fetch_image in multimodal chat completions |
| CVE-2026-45804 | DI diffusers huggingface | 7.5 | Jul 15 | Diffusers: TOCTOU Trust Remote Code Bypass |
| CVE-2026-5241 | HU huggingface/transformers huggingface | 9.6 | Jun 3 | Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers |
| CVE-2026-4372 | HU huggingface/transformers huggingface | 7.8 | May 24 | Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers |
| CVE-2026-44827 | DI diffusers huggingface | 8.8 | May 14 | Diffusers: None.py Trust Remote Code Bypass |
| CVE-2026-44513 | DI diffusers huggingface | 8.8 | May 14 | Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components |
| CVE-2026-25874 | LE Lerobot Huggingface | 9.8 | Apr 23 | LeRobot Unsafe Deserialization Remote Code Execution via gRPC |
| CVE-2026-1839 | HU huggingface/transformers huggingface | 7.8 | Apr 7 | Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers |
| CVE-2026-4963 | SM smolagents huggingface | 10.0 | Mar 27 | huggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injection |
| CVE-2026-2654 | SM smolagents huggingface | 9.8 | Feb 18 | huggingface smolagents LocalPythonExecutor requests.post server-side request forgery |
| CVE-2026-0599 | HU huggingface/text-generation-inference huggingface | 7.5 | Feb 2 | Unbounded External Image Fetch in Validation Leads to Resource-Exhaustion DoS in huggingface/text-generation-inference |
| CVE-2025-14930 | TR Transformers Huggingface | 7.8 | Dec 23 | Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2025-14928 | TR Transformers Huggingface | 7.8 | Dec 23 | Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability |
| CVE-2025-14924 | TR Transformers Huggingface | 7.8 | Dec 23 | Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2025-14920 | TR Transformers Huggingface | 7.8 | Dec 23 | Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2025-14926 | TR Transformers Huggingface | 7.8 | Dec 23 | Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability |
| CVE-2025-14927 | TR Transformers Huggingface | 7.8 | Dec 23 | Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability |
| CVE-2025-14921 | TR Transformers Huggingface | 7.8 | Dec 23 | Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2025-14929 | TR Transformers Huggingface | 7.8 | Dec 23 | Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2025-11844 | HU huggingface/smolagents huggingface | 5.4 | Oct 22 | XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function |
| CVE-2025-6921 | HU huggingface/transformers huggingface | 7.5 | Sep 23 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers |
| CVE-2025-10772 | LE LeRobot huggingface | 6.3 | Sep 21 | huggingface LeRobot ZeroMQ Socket lekiwi_remote.py missing authentication |
| CVE-2025-6051 | HU huggingface/transformers huggingface | 5.3 | Sep 14 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers |
| CVE-2025-6638 | HU huggingface/transformers huggingface | 7.5 | Sep 12 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers |
| CVE-2025-5197 | HU huggingface/transformers huggingface | 5.3 | Aug 6 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers |
| CVE-2025-5120 | HU huggingface/smolagents huggingface | 10.0 | Jul 27 | Sandbox Escape Vulnerability in huggingface/smolagents |
| CVE-2025-3933 | HU huggingface/transformers huggingface | 5.3 | Jul 11 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers |
| CVE-2025-3777 | HU huggingface/transformers huggingface | 3.5 | Jul 7 | Improper Input Validation in huggingface/transformers |
| CVE-2025-3264 | HU huggingface/transformers huggingface | 5.3 | Jul 7 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers |
| CVE-2025-3263 | HU huggingface/transformers huggingface | 5.3 | Jul 7 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers |
| CVE-2025-3262 | HU huggingface/transformers huggingface | 7.5 | Jul 7 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers |
| CVE-2025-2099 | HU huggingface/transformers huggingface | 7.5 | May 19 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers |
| CVE-2025-1194 | HU huggingface/transformers huggingface | 6.5 | Apr 29 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers |
| CVE-2024-12720 | HU huggingface/transformers huggingface | 7.5 | Mar 20 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers |
| CVE-2024-11394 | TR Transformers Huggingface | 8.8 | Nov 22 | Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2024-11393 | TR Transformers Huggingface | 8.8 | Nov 22 | Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2024-11392 | TR Transformers Huggingface | 8.8 | Nov 22 | Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2024-3924 | HU huggingface/text-generation-inference huggingface | 4.4 | May 30 | Code Injection in huggingface/text-generation-inference |
| CVE-2024-3568 | HU huggingface/transformers huggingface | 9.6 | Apr 10 | Arbitrary Code Execution via Deserialization in huggingface/transformers |
| CVE-2023-7018 | TR Transformers Huggingface | 7.8 | Dec 20 | Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36 |
| CVE-2023-6730 | TR Transformers Huggingface | 8.8 | Dec 19 | Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36 |
| CVE-2023-2800 | TR Transformers Huggingface | 4.7 | May 18 | Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0 |