Log in Start free

Hugging Face

Products

ProductCVEsExploitedLatest
Transformers12–Sep 1, 2026
LeRobot2–Oct 26, 2026
PyTorch Image Models1–Aug 20, 2026
Accelerate1–Dec 23, 2025
smolagents1–Dec 23, 2025
Text Embeddings Inference1–Oct 11, 2026
sentence-transformers1–Jul 31, 2026
Diffusers1–Dec 23, 2025

Exploited and recent CVEs

  • CVE-2026-115533 Unrated CVE-2026-115533 0.3%
  • CVE-2026-108857 Low 3.3 Hugging Face Text Embeddings Inference through 1.9.4 Cleartext API Key Logging 0.1%
  • CVE-2026-80047 High 7.8 Hugging Face Transformers library writes remote code to disk prior to consent check <0.1%
  • CVE-2026-15679 High 7.8 Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability 0.4%
  • CVE-2026-68770 Critical 9.8 sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False 0.9%
  • CVE-2026-25874 Critical 9.3 LeRobot Unsafe Deserialization Remote Code Execution via gRPC 15.5%
  • CVE-2025-14925 High 7.8 Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability 0.4%
  • CVE-2025-14922 High 7.8 Hugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution Vulnerability 0.4%
  • CVE-2025-14931 Critical 10.0 Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability 1.2%
  • CVE-2025-14930 High 7.8 Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability 0.3%
  • CVE-2025-14928 High 7.8 Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability 0.3%
  • CVE-2025-14924 High 7.8 Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability 0.3%
  • CVE-2025-14920 High 7.8 Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability 0.4%
  • CVE-2025-14926 High 7.8 Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability 0.3%
  • CVE-2025-14927 High 7.8 Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability 0.3%
  • CVE-2025-14921 High 7.8 Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability 0.3%
  • CVE-2025-14929 High 7.8 Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability 0.4%
  • CVE-2024-11394 High 8.8 Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability 2.7%
  • CVE-2024-11393 High 8.8 Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability 3.3%
  • CVE-2024-11392 High 7.5 Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability 7.7%