CVEs for Hugging Face
53 matching vulnerabilities, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-85670 tokenizers BpeBuilder Buffer Overflow via merge token
CVSS 6.5 mediumEPSS 0.47%Hugging Face
CVE-2026-75104 Hugging Face Transformers Path Traversal via Checkpoint Index
CVSS 5.5 mediumEPSS 0.29%Hugging Face
CVE-2026-69112 Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map
CVSS 7.1 highEPSS 0.19%Hugging Face
CVE-2026-9856 Path Traversal in huggingface/transformers
CVSS 7.1 highEPSS 0.46%Hugging Face
CVE-2026-66007 Datasets Path Traversal via Unsanitized file_name Metadata
CVSS 6.5 mediumEPSS 0.55%Hugging Face
CVE-2026-65010 Datasets Symlink-following Arbitrary File Write via Extractor.extract()
CVSS 6.6 mediumEPSS 0.17%Hugging Face
CVE-2026-65920 Diffusers Path Traversal via weight_map Arbitrary File Read
CVSS 4.3 mediumEPSS 0.40%Hugging Face
CVE-2026-45804 Diffusers: TOCTOU Trust Remote Code Bypass
CVSS 7.5 highEPSS 0.37%Hugging Face
CVE-2026-44827 Diffusers: None.py Trust Remote Code Bypass
CVSS 8.8 highEPSS 0.72%Hugging Face
CVE-2026-25874 LeRobot Unsafe Deserialization Remote Code Execution via gRPC
CVSS 9.8 criticalEPSS 15.5%Hugging Face
CVE-2025-11844 XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function
CVSS 5.4 mediumEPSS 0.28%Hugging Face
CVE-2025-6921 Regular Expression Denial of Service (ReDoS) in huggingface/transformers
CVSS 5.3 mediumEPSS 0.51%Hugging Face
CVE-2025-10772 huggingface LeRobot ZeroMQ Socket lekiwi_remote.py missing authentication
CVSS 6.3 mediumEPSS 0.29%Hugging Face
CVE-2025-6051 Regular Expression Denial of Service (ReDoS) in huggingface/transformers
CVSS 5.3 mediumEPSS 0.38%Hugging Face
CVE-2025-6638 Regular Expression Denial of Service (ReDoS) in huggingface/transformers
CVSS 5.3 mediumEPSS 0.55%Hugging Face
CVE-2025-5197 Regular Expression Denial of Service (ReDoS) in huggingface/transformers
CVSS 5.3 mediumEPSS 0.39%Hugging Face
CVE-2025-5120 Sandbox Escape Vulnerability in huggingface/smolagents
CVSS 7.6 highEPSS 26.3%Hugging Face
CVE-2025-3933 Regular Expression Denial of Service (ReDoS) in huggingface/transformers
CVSS 5.3 mediumEPSS 0.50%Hugging Face
CVE-2025-3777 Improper Input Validation in huggingface/transformers
CVSS 3.5 lowEPSS 0.41%Hugging Face
CVE-2025-3264 Regular Expression Denial of Service (ReDoS) in huggingface/transformers
CVSS 5.3 mediumEPSS 0.50%Hugging Face
CVE-2025-3263 Regular Expression Denial of Service (ReDoS) in huggingface/transformers
CVSS 5.3 mediumEPSS 0.50%Hugging Face
CVE-2025-3262 Regular Expression Denial of Service (ReDoS) in huggingface/transformers
CVSS 5.3 mediumEPSS 0.49%Hugging Face
CVE-2025-2099 Regular Expression Denial of Service (ReDoS) in huggingface/transformers
CVSS 5.3 mediumEPSS 0.61%Hugging Face
CVE-2025-1194 Regular Expression Denial of Service (ReDoS) in huggingface/transformers
CVSS 4.3 mediumEPSS 0.48%Hugging Face
CVE-2024-12720 Regular Expression Denial of Service (ReDoS) in huggingface/transformers
CVSS 5.3 mediumEPSS 0.75%Hugging Face
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)