Vendor
Hugging Face
20 known vulnerabilities in products by Hugging Face, 0 of them actively exploited (CISA KEV).
Key figures
20
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-25874 | LeRobot Unsafe Deserialization Remote Code Execution via gRPC | 9.8 | |
| High | CVE-2024-11392 | Hugging Face Transformers: Deserialization of Untrusted Data | 7.5 | |
| High | CVE-2024-11393 | Hugging Face Transformers: Deserialization of Untrusted Data | 8.8 | |
| High | CVE-2024-11394 | Hugging Face Transformers: Deserialization of Untrusted Data | 8.8 | |
| Critical | CVE-2025-14931 | Hugging Face Smolagents: Deserialization of Untrusted Data | 10.0 | |
| Critical | CVE-2026-68770 | sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False | 9.8 | |
| High | CVE-2026-15679 | Hugging Face PyTorch Image Models: Deserialization of Untrusted Data | 7.8 | |
| High | CVE-2026-80047 | Hugging Face Transformers library writes remote code to disk prior to consent check | 7.8 | |
| High | CVE-2025-14925 | Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability | 7.8 | |
| High | CVE-2025-14922 | Hugging Face Diffusers: Deserialization of Untrusted Data | 7.8 | |
| High | CVE-2025-14929 | Hugging Face Transformers: Deserialization of Untrusted Data | 7.8 | |
| High | CVE-2025-14920 | Hugging Face Transformers: Deserialization of Untrusted Data | 7.8 | |
| High | CVE-2025-14928 | Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability | 7.8 | |
| High | CVE-2025-14926 | Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability | 7.8 | |
| High | CVE-2025-14927 | Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability | 7.8 | |
| High | CVE-2025-14930 | Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability | 7.8 | |
| High | CVE-2025-14924 | Hugging Face Transformers: Deserialization of Untrusted Data | 7.8 | |
| High | CVE-2025-14921 | Hugging Face Transformers: Deserialization of Untrusted Data | 7.8 | |
| Medium | CVE-2026-108857 | Hugging Face Text Embeddings Inference through 1.9.4 Cleartext API Key Logging | 3.3 | |
| Not rated | CVE-2026-115533 | Hugging Face LeRobot: Code Execution | — |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 30sans-atrisk-mail,
Products
| Transformers | 12 | 0 |