Browse CVEs

MEDIUM 6.5 CVE-2026-66007 Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadat… Datasets No fix yet Fix from $1,6002026-07-24 HIGH 7.5 CVE-2026-45804 Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_r… Diffusers 0.38.0+ Fix from $1,9502026-07-15 CRITICAL 9.6 CVE-2026-5241 A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execu… Transformers Patch available Fix from $2,3002026-06-03 HIGH 7.8 CVE-2026-4372 A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerabili… Transformers 5.3.0+ Fix from $1,9502026-05-24 HIGH 8.8 CVE-2026-44827 Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execution without the trust_remote_… Diffusers 0.38.0+ Fix from $1,9502026-05-14 HIGH 8.8 CVE-2026-44513 Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows … Diffusers 0.38.0+ Fix from $1,9502026-05-14 CRITICAL 9.8 CVE-2026-25874EPSS 16% LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize da… Lerobot after 0.5.1 Fix from $2,3002026-04-23 HIGH 7.8 CVE-2026-1839 A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_sta… Transformers 5.0.0+ Fix from $1,9502026-04-07 CRITICAL 10.0 CVE-2026-4963 A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function evaluate_augassign/evaluate_call/evaluate_with of the… Smolagents Mitigation only Fix from $2,3002026-03-27 CRITICAL 9.8 CVE-2026-2654 A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExec… Smolagents after 1.24.0 Fix from $2,3002026-02-18 HIGH 7.8 CVE-2025-14928 Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exe… Transformers Mitigation only Fix from $1,9502025-12-23 HIGH 7.8 CVE-2025-14929 Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allo… Transformers Mitigation only Fix from $1,9502025-12-23 HIGH 7.8 CVE-2025-14930 Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to e… Transformers Mitigation only Fix from $1,9502025-12-23 HIGH 7.8 CVE-2025-14920 Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote att… Transformers Mitigation only Fix from $1,9502025-12-23 HIGH 7.8 CVE-2025-14921 Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remot… Transformers Mitigation only Fix from $1,9502025-12-23 HIGH 7.8 CVE-2025-14924 Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attac… Transformers Mitigation only Fix from $1,9502025-12-23 HIGH 7.8 CVE-2025-14926 Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… Transformers Mitigation only Fix from $1,9502025-12-23 HIGH 7.8 CVE-2025-14927 Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exec… Transformers Mitigation only Fix from $1,9502025-12-23 MEDIUM 5.4 CVE-2025-11844 Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_… Smolagents 1.22.0+ Fix from $1,6002025-10-22 HIGH 7.5 CVE-2025-6921 The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay … Transformers 4.53.0+ Fix from $1,9502025-09-23 MEDIUM 5.3 CVE-2025-6051 A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normal… Transformers Patch available Fix from $1,6002025-09-14 HIGH 7.5 CVE-2025-6638 A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the Mari… Transformers Patch available Fix from $1,9502025-09-12 MEDIUM 5.3 CVE-2025-5197 A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_… Transformers 4.53.0+ Fix from $1,6002025-08-06 CRITICAL 10.0 CVE-2025-5120EPSS 20% A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environ… Smolagents Patch available Fix from $2,3002025-07-27 MEDIUM 5.3 CVE-2025-3933 A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutPr… Transformers 4.52.1+ Fix from $1,6002025-07-11 HIGH 7.5 CVE-2025-3262 A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.… Transformers 4.51.0+ Fix from $1,9502025-07-07 MEDIUM 5.3 CVE-2025-3263 A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_config… Transformers 4.51.0+ Fix from $1,6002025-07-07 MEDIUM 5.3 CVE-2025-3264 A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_import… Transformers 4.51.0+ Fix from $1,6002025-07-07 HIGH 7.5 CVE-2025-2099 A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows f… Transformers after 4.48.3 Fix from $1,9502025-05-19 MEDIUM 6.5 CVE-2025-1194 A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokeni… Transformers 4.50.0+ Fix from $1,6002025-04-29