Log in Start free

huggingface

Products

ProductCVEsExploitedLatest
huggingface/transformers20–Aug 2, 2026
diffusers4–Jul 23, 2026
datasets3–Oct 23, 2026
smolagents2–Mar 27, 2026
huggingface/smolagents2–Oct 22, 2025
huggingface/text-generation-inference2–Feb 2, 2026
transformers1–Aug 17, 2026
LeRobot1–Sep 21, 2025
peft1–Aug 5, 2026
text-generation-inference1–Jul 16, 2026
tokenizers1–Sep 4, 2026
accelerate1–Aug 10, 2026

Exploited and recent CVEs

  • CVE-2026-57845 High 8.8 Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder 0.5%
  • CVE-2026-85670 Medium 6.5 tokenizers BpeBuilder Buffer Overflow via merge token 0.5%
  • CVE-2026-75104 Medium 5.5 Hugging Face Transformers Path Traversal via Checkpoint Index 0.3%
  • CVE-2026-69112 High 7.1 Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map 0.2%
  • CVE-2026-71281 High 8.8 peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules 0.5%
  • CVE-2026-9856 High 7.1 Path Traversal in huggingface/transformers 0.5%
  • CVE-2026-66007 Medium 6.5 Datasets Path Traversal via Unsanitized file_name Metadata 0.5%
  • CVE-2026-65010 Medium 6.6 Datasets Symlink-following Arbitrary File Write via Extractor.extract() 0.2%
  • CVE-2026-65920 Medium 4.3 Diffusers Path Traversal via weight_map Arbitrary File Read 0.4%
  • CVE-2026-63086 High 8.6 text-generation-inference 3.3.7 SSRF via fetch_image in multimodal chat completions 0.4%
  • CVE-2026-45804 High 7.5 Diffusers: TOCTOU Trust Remote Code Bypass 0.4%
  • CVE-2026-5241 High 7.7 Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers 0.6%
  • CVE-2026-4372 High 7.8 Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers 0.7%
  • CVE-2026-44827 High 8.8 Diffusers: None.py Trust Remote Code Bypass 0.7%
  • CVE-2026-44513 High 8.8 Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components 1.1%
  • CVE-2026-1839 Medium 6.5 Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers 0.4%
  • CVE-2026-4963 Medium 6.3 huggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injection 0.6%
  • CVE-2026-2654 Medium 6.3 huggingface smolagents LocalPythonExecutor requests.post server-side request forgery 0.4%
  • CVE-2026-0599 High 7.5 Unbounded External Image Fetch in Validation Leads to Resource-Exhaustion DoS in huggingface/text-generation-inference 29.5%
  • CVE-2025-11844 Medium 5.4 XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function 0.3%
  • CVE-2025-6921 Medium 5.3 Regular Expression Denial of Service (ReDoS) in huggingface/transformers 0.5%
  • CVE-2025-10772 Medium 6.3 huggingface LeRobot ZeroMQ Socket lekiwi_remote.py missing authentication 0.3%
  • CVE-2025-6051 Medium 5.3 Regular Expression Denial of Service (ReDoS) in huggingface/transformers 0.4%
  • CVE-2025-6638 Medium 5.3 Regular Expression Denial of Service (ReDoS) in huggingface/transformers 0.6%
  • CVE-2025-5197 Medium 5.3 Regular Expression Denial of Service (ReDoS) in huggingface/transformers 0.4%
  • CVE-2025-5120 High 7.6 Sandbox Escape Vulnerability in huggingface/smolagents 31.2%
  • CVE-2025-3933 Medium 5.3 Regular Expression Denial of Service (ReDoS) in huggingface/transformers 0.5%
  • CVE-2025-3777 Low 3.5 Improper Input Validation in huggingface/transformers 0.4%
  • CVE-2025-3264 Medium 5.3 Regular Expression Denial of Service (ReDoS) in huggingface/transformers 0.5%
  • CVE-2025-3263 Medium 5.3 Regular Expression Denial of Service (ReDoS) in huggingface/transformers 0.5%