H
Vendor security profile
huggingface
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs15
Critical1
CISA KEV0
Public exploit13
Patch rate%60
Avg. CVSS7.3
12-month vulnerability rate
0
0
0
0
0
1
3
1
3
4
0
0
CVE KEV
CVE severity distribution
15toplam CVE
Critical1 (7%)
High8 (53%)
Medium6 (40%)
Patch and exploitation view
%60
Verified patch
%0
CISA KEV
%87
Public exploit
9Patch available
0Partial
0Workaround
0Vendor: no patch
6Unknown
Latest vulnerabilities
6.8
CVE-2026-75104
Hugging Face Transformers Path Traversal via Checkpoint Index
H
Patch status unknownEPSS %0
6.9
CVE-2026-69112
Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map
H
Patch status unknownEPSS %0
8.8
CVE-2026-71281
peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules
H
Patch status unknownEPSS %0
7.1
CVE-2026-9856
Path Traversal in huggingface/transformers
H
Patch status unknownEPSS %0
6.9
CVE-2026-66007
Datasets Path Traversal via Unsanitized file_name Metadata
H
Patch verifiedEPSS %1
4.4
CVE-2026-65010
Datasets Symlink-following Arbitrary File Write via Extractor.extract()
H
Patch verifiedEPSS %0
7.5
CVE-2026-45804
Vulnerability in Huggingface Diffusers
H
Patch verifiedEPSS %0
8.0
CVE-2026-5241
Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers
H
Patch verifiedEPSS %1
7.8
CVE-2026-4372
Deserialization of untrusted data in Huggingface Transformers
H
Patch verifiedEPSS %1
8.8
CVE-2026-44513
Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components
H
Patch status unknownEPSS %1