HU
Vendor
huggingface
51
CVEs
0
On KEV
1
New 30D
Products
DA8.8
datasets
huggingface
3 CVEs0 on KEV1 new
TR9.6
transformers
huggingface
31 CVEs0 on KEV0 new
DI8.8
diffusers
huggingface
4 CVEs0 on KEV0 new
HU9.6
huggingface/transformers
huggingface
4 CVEs0 on KEV0 new
SM10.0
smolagents
huggingface
4 CVEs0 on KEV0 new
AC7.1
accelerate
huggingface
1 CVEs0 on KEV0 new
LE9.8
Lerobot
Huggingface
1 CVEs0 on KEV0 new
PE8.8
peft
huggingface
1 CVEs0 on KEV0 new
TE8.6
text-generation-inference
huggingface
1 CVEs0 on KEV0 new
TO6.5
tokenizers
huggingface
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-57845 New | DA datasets huggingface | 8.8 | Oct 23 | Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder |
| CVE-2026-85670 | TO tokenizers huggingface | 6.5 | Sep 4 | tokenizers BpeBuilder Buffer Overflow via merge token |
| CVE-2026-75104 | TR transformers huggingface | 5.5 | Aug 17 | Hugging Face Transformers Path Traversal via Checkpoint Index |
| CVE-2026-69112 | AC accelerate huggingface | 7.1 | Aug 10 | Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map |
| CVE-2026-71281 | PE peft huggingface | 8.8 | Aug 5 | peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules |
| CVE-2026-9856 | HU huggingface/transformers huggingface | 7.1 | Aug 2 | Path Traversal in huggingface/transformers |
| CVE-2026-66007 | DA datasets huggingface | 6.5 | Jul 24 | Datasets Path Traversal via Unsanitized file_name Metadata |
| CVE-2026-65010 | DA datasets huggingface | 6.6 | Jul 23 | Datasets Symlink-following Arbitrary File Write via Extractor.extract() |
| CVE-2026-65920 | DI diffusers huggingface | 4.3 | Jul 23 | Diffusers Path Traversal via weight_map Arbitrary File Read |
| CVE-2026-63086 | TE text-generation-inference huggingface | 8.6 | Jul 16 | text-generation-inference 3.3.7 SSRF via fetch_image in multimodal chat completions |
| CVE-2026-45804 | DI diffusers huggingface | 7.5 | Jul 15 | Diffusers: TOCTOU Trust Remote Code Bypass |
| CVE-2026-5241 | HU huggingface/transformers huggingface | 9.6 | Jun 3 | Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers |
| CVE-2026-4372 | HU huggingface/transformers huggingface | 7.8 | May 24 | Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers |
| CVE-2026-44827 | DI diffusers huggingface | 8.8 | May 14 | Diffusers: None.py Trust Remote Code Bypass |
| CVE-2026-44513 | DI diffusers huggingface | 8.8 | May 14 | Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components |
| CVE-2026-25874 | LE Lerobot Huggingface | 9.8 | Apr 23 | LeRobot Unsafe Deserialization Remote Code Execution via gRPC |
| CVE-2026-1839 | HU huggingface/transformers huggingface | 7.8 | Apr 7 | Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers |
| CVE-2026-4963 | SM smolagents huggingface | 10.0 | Mar 27 | huggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injection |
| CVE-2026-2654 | SM Smolagents Huggingface | 9.8 | Feb 18 | A weakness has been identified in huggingface smolagents 1.24.0 |
| CVE-2025-14930 | TR Transformers Huggingface | 7.8 | Dec 23 | Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2025-14929 | TR Transformers Huggingface | 7.8 | Dec 23 | Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2025-14928 | TR Transformers Huggingface | 7.8 | Dec 23 | Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability |
| CVE-2025-14927 | TR Transformers Huggingface | 7.8 | Dec 23 | Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability |
| CVE-2025-14926 | TR Transformers Huggingface | 7.8 | Dec 23 | Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability |
| CVE-2025-14924 | TR Transformers Huggingface | 7.8 | Dec 23 | Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2025-14921 | TR Transformers Huggingface | 7.8 | Dec 23 | Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2025-14920 | TR Transformers Huggingface | 7.8 | Dec 23 | Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2025-11844 | SM Smolagents Huggingface | 5.4 | Oct 22 | Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py |
| CVE-2025-6921 | TR Transformers Huggingface | 7.5 | Sep 23 | The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer |
| CVE-2025-6051 | TR Transformers Huggingface | 5.3 | Sep 14 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the… |
| CVE-2025-6638 | TR Transformers Huggingface | 7.5 | Sep 12 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's… |
| CVE-2025-5197 | TR Transformers Huggingface | 5.3 | Aug 6 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt_weight_name()`… |
| CVE-2025-5120 | SM Smolagents Huggingface | 10.0 | Jul 27 | A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code… |
| CVE-2025-3933 | TR Transformers Huggingface | 5.3 | Jul 11 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()`… |
| CVE-2025-3777 | TR Transformers Huggingface | 3.5 | Jul 7 | Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file |
| CVE-2025-3264 | TR Transformers Huggingface | 5.3 | Jul 7 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within… |
| CVE-2025-3263 | TR Transformers Huggingface | 5.3 | Jul 7 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_configuration_file()` function… |
| CVE-2025-3262 | TR Transformers Huggingface | 7.5 | Jul 7 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0 |
| CVE-2025-2099 | TR Transformers Huggingface | 7.5 | May 19 | A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial… |
| CVE-2025-1194 | TR Transformers Huggingface | 6.5 | Apr 29 | A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py`… |
| CVE-2024-12720 | TR Transformers Huggingface | 7.5 | Mar 20 | A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py |
| CVE-2024-11394 | TR Transformers Huggingface | 8.8 | Nov 22 | Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2024-11393 | TR Transformers Huggingface | 8.8 | Nov 22 | Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2024-11392 | TR Transformers Huggingface | 8.8 | Nov 22 | Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2024-3568 | TR Transformers Huggingface | 9.6 | Apr 10 | The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_repo_checkpoint()` function of the… |
| CVE-2023-7018 | TR Transformers Huggingface | 7.8 | Dec 20 | Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36 |
| CVE-2023-6730 | TR Transformers Huggingface | 8.8 | Dec 19 | Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36 |
| CVE-2023-2800 | TR Transformers Huggingface | 4.7 | May 18 | Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0 |