Skip to content
Noroxi

huggingface records

40 published records for vendor huggingface.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
10
With a fix record
72.5%
Median publish → KEV
No record has entered KEV

Records by year

  1. 23
  2. 24
  3. 25
  4. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

40 records
  • CVE-2025-5120
    48Plan

    Sandbox Escape Vulnerability in huggingface/smolagents

    CriticalCVSS 10.0No exploitEPSS 26%

    huggingface · smolagentsJul 27, 2025

  • CVE-2024-3568
    39Monitor

    Arbitrary Code Execution via Deserialization in huggingface/transformers

    CriticalCVSS 9.6Proof of conceptEPSS 2%

    huggingface · transformersApr 10, 2024

  • CVE-2026-5241
    38Monitor

    Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers

    CriticalCVSS 9.6No exploitEPSS 0%

    huggingface · transformersJun 3, 2026

  • CVE-2024-11392
    37Monitor

    Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 7%

    huggingface · transformersNov 22, 2024

  • CVE-2026-25874
    37Monitor

    LeRobot Unsafe Deserialization Remote Code Execution via gRPC

    CriticalCVSS 9.3No exploitEPSS 0%

    huggingface · lerobotApr 23, 2026

  • CVE-2024-11393
    36Monitor

    Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 3%

    huggingface · transformersNov 22, 2024

  • CVE-2024-11394
    36Monitor

    Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 2%

    huggingface · transformersNov 22, 2024

  • CVE-2023-6730
    35Monitor

    Deserialization of Untrusted Data in huggingface/transformers

    HighCVSS 8.8No exploitEPSS 0%

    huggingface · transformersDec 19, 2023

  • CVE-2026-44513
    35Monitor

    Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components

    HighCVSS 8.8No exploitEPSS 0%

    huggingface · diffusersMay 14, 2026

  • CVE-2026-44827
    35Monitor

    Diffusers: None.py Trust Remote Code Bypass

    HighCVSS 8.8No exploitEPSS 0%

    huggingface · diffusersMay 14, 2026

  • CVE-2023-7018
    31Monitor

    Deserialization of Untrusted Data in huggingface/transformers

    HighCVSS 7.8No exploitEPSS 0%

    huggingface · transformersDec 20, 2023

  • CVE-2026-4372
    31Monitor

    Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers

    HighCVSS 7.8No exploitEPSS 0%

    huggingface · transformersMay 24, 2026

  • CVE-2026-1839
    31Monitor

    Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers

    HighCVSS 7.8No exploitEPSS 0%

    huggingface · transformersApr 7, 2026

  • CVE-2025-14929
    31Monitor

    Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 0%

    huggingface · transformersDec 23, 2025

  • CVE-2025-14920
    31Monitor

    Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 0%

    huggingface · transformersDec 23, 2025

  • CVE-2025-14926
    31Monitor

    Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 0%

    huggingface · transformersDec 23, 2025

  • CVE-2025-14927
    31Monitor

    Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 0%

    huggingface · transformersDec 23, 2025

  • CVE-2025-14928
    31Monitor

    Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 0%

    huggingface · transformersDec 23, 2025

  • CVE-2025-14921
    31Monitor

    Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 0%

    huggingface · transformersDec 23, 2025

  • CVE-2025-14924
    31Monitor

    Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 0%

    huggingface · transformersDec 23, 2025

  • CVE-2025-14930
    31Monitor

    Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 0%

    huggingface · transformersDec 23, 2025

  • CVE-2024-12720
    30Monitor

    Regular Expression Denial of Service (ReDoS) in huggingface/transformers

    HighCVSS 7.5No exploitEPSS 0%

    huggingface · transformersMar 20, 2025

  • CVE-2025-2099
    30Monitor

    Regular Expression Denial of Service (ReDoS) in huggingface/transformers

    HighCVSS 7.5No exploitEPSS 0%

    huggingface · transformersMay 19, 2025

  • CVE-2025-6638
    30Monitor

    Regular Expression Denial of Service (ReDoS) in huggingface/transformers

    HighCVSS 7.5No exploitEPSS 0%

    huggingface · transformersSep 12, 2025

  • CVE-2025-6921
    30Monitor

    Regular Expression Denial of Service (ReDoS) in huggingface/transformers

    HighCVSS 7.5No exploitEPSS 0%

    huggingface · transformersSep 23, 2025