CVE Tools
Track your stack

Huggingface

18 CVEs tracked since 2025. Since Jul 2025, none of them reached CISA KEV.

Huggingface CVEs per month

Jul 2025 to Dec 2025. Point at a month, or focus the strip and use the arrow keys.
Huggingface CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2025-0760
2025-08null or fewer
2025-0940
2025-10null or fewer
2025-11null or fewer
2025-1280

Products

The products that kept showing up in Huggingface's monthly top three, with their CVEs summed over those months.

  1. Transformers163 months
  2. Huggingface/transformers82 months
  3. Huggingface/smolagents11 month
  4. Lerobot11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Huggingface.

  1. CVE-2026-85670tokenizers BpeBuilder Buffer Overflow via merge token6.5
  2. CVE-2026-75104Hugging Face Transformers Path Traversal via Checkpoint Index5.5
  3. CVE-2026-69112Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map7.1
  4. CVE-2026-71281peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules8.8
  5. CVE-2026-9856Path Traversal in huggingface/transformers7.1
  6. CVE-2026-66007Datasets Path Traversal via Unsanitized file_name Metadata6.5
  7. CVE-2026-65010Datasets Symlink-following Arbitrary File Write via Extractor.extract()6.6
  8. CVE-2026-65920Diffusers Path Traversal via weight_map Arbitrary File Read4.3
  9. CVE-2026-63086text-generation-inference 3.3.7 SSRF via fetch_image in multimodal chat completions8.6
  10. CVE-2026-45804Diffusers: TOCTOU Trust Remote Code Bypass7.5
  11. CVE-2026-5241Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers9.6
  12. CVE-2026-4372Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers7.8
  13. CVE-2026-44827Diffusers: None.py Trust Remote Code Bypass8.8
  14. CVE-2026-44513Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components8.8
  15. CVE-2026-25874LeRobot Unsafe Deserialization Remote Code Execution via gRPC9.8

The record

Peak rank
#119 in Dec 2025
Busiest month shown
Dec 2025, 8 CVEs
Months with a KEV entry
0 since Jul 2025
Monthly snapshots
3 since 2025
Huggingface's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store