Hugging Face vulnerabilities

CVEs per yearBy the year they were published

1. 20243
2. 202511
3. 20266

Newest CVEs

• CVE-2026-115533

  CVE-2026-115533

  Hugging Face · LeRobot

  Not scored
• CVE-2026-108857

  Hugging Face Text Embeddings Inference through 1.9.4 Cleartext API Key Logging

  Hugging Face · Text Embeddings Inference

  Medium4.8
• CVE-2026-80047

  Hugging Face Transformers library writes remote code to disk prior to consent check

  Hugging Face · Transformers

  High7.8
• CVE-2026-15679

  Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

  Hugging Face · PyTorch Image Models

  High7.8
• CVE-2026-68770

  sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False

  Hugging Face · sentence-transformers

  Critical9.3
• CVE-2026-25874

  LeRobot Unsafe Deserialization Remote Code Execution via gRPC

  Hugging Face · LeRobot

  Critical9.3
• CVE-2025-14925

  Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability

  Hugging Face · Accelerate

  High7.8
• CVE-2025-14922

  Hugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution Vulnerability

  Hugging Face · Diffusers

  High7.8
• CVE-2025-14931

  Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability

  Hugging Face · smolagents

  Critical10.0
• CVE-2025-14930

  Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability

  Hugging Face · Transformers

  High7.8