Product by Hugging Face
Hugging Face Transformers
32 known vulnerabilities in Hugging Face Transformers (Hugging Face), 0 of them actively exploited (CISA KEV).
Key figures
32
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2024-11392 | Hugging Face Transformers: Deserialization of Untrusted Data | 7.5 | |
| High | CVE-2024-11393 | Hugging Face Transformers: Deserialization of Untrusted Data | 8.8 | |
| High | CVE-2024-11394 | Hugging Face Transformers: Deserialization of Untrusted Data | 8.8 | |
| High | CVE-2026-4372 | Huggingface/transformers: Missing Serialization Control Element | 7.8 | |
| Critical | CVE-2023-6730 | Deserialization of Untrusted Data in huggingface/transformers | 9.0 | |
| Critical | CVE-2026-5241 | Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers | 8.0 | |
| Critical | CVE-2023-7018 | Deserialization of Untrusted Data in huggingface/transformers | 9.6 | |
| Critical | CVE-2024-3568 | Arbitrary Code Execution via Deserialization in huggingface/transformers | 3.4 | |
| High | CVE-2026-9856 | Path Traversal in huggingface/transformers | 7.1 | |
| High | CVE-2026-1839 | Huggingface/transformers: Deserialization of Untrusted Data | 7.8 | |
| Medium | CVE-2026-75104 | Hugging Face Transformers Path Traversal via Checkpoint Index | 5.5 | |
| High | CVE-2025-14929 | Hugging Face Transformers: Deserialization of Untrusted Data | 7.8 | |
| High | CVE-2024-12720 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers | 5.3 | |
| High | CVE-2025-14920 | Hugging Face Transformers: Deserialization of Untrusted Data | 7.8 | |
| High | CVE-2025-14928 | Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability | 7.8 | |
| High | CVE-2025-14926 | Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability | 7.8 | |
| High | CVE-2025-14927 | Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability | 7.8 | |
| High | CVE-2025-14921 | Hugging Face Transformers: Deserialization of Untrusted Data | 7.8 | |
| High | CVE-2025-14930 | Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability | 7.8 | |
| High | CVE-2025-14924 | Hugging Face Transformers: Deserialization of Untrusted Data | 7.8 | |
| High | CVE-2025-2099 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers | 5.3 | |
| High | CVE-2025-6638 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers | 5.3 | |
| High | CVE-2025-6921 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers | 5.3 | |
| Medium | CVE-2025-3933 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers | 5.3 | |
| Medium | CVE-2025-3264 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers | 5.3 |