HF
Vendor security profile
Hugging Face
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs4
Critical1
CISA KEV0
Public exploit1
Patch rate%25
Avg. CVSS7.4
12-month vulnerability rate
0
0
0
0
0
0
0
0
1
1
1
1
CVE KEV
CVE severity distribution
4toplam CVE
Critical1 (25%)
High2 (50%)
Medium1 (25%)
Patch and exploitation view
%25
Verified patch
%0
CISA KEV
%25
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
3Unknown
Latest vulnerabilities
4.8
CVE-2026-108857
Hugging Face Text Embeddings Inference through 1.9.4 Cleartext API Key Logging
HF
Patch status unknown
7.8
CVE-2026-80047
Hugging Face Transformers library writes remote code to disk prior to consent check
HF
Patch status unknownEPSS %0
7.8
CVE-2026-15679
Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability
HF
Patch status unknownEPSS %0
9.3
CVE-2026-68770
sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False
HF
Patch verifiedEPSS %1