Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read just now.
At a glance
Published CVEs; rejected ones are not counted.
- 405,790All CVEsplus 19,170 rejected
- 332Last 24 hours4,863 in the last 7 days
- 16,859Last 30 days1,490 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 10 | 10 | 0 | 0 | 20 | 40 |
| 2025 | 0 | 1 | 13 | 1 | 0 | 15 | 20 |
| 2024 | 0 | 0 | 1 | 1 | 0 | 2 | 5 |
| 2023 | 2 | 0 | 1 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-124588 | huggingface finetrainers Model Index model.py resolve_component_cls code injectionPublic exploithuggingface · finetrainers | Medium5.3 |
| CVE-2026-57845 | Hugging Face Datasets < 5.2.0 Pickle Deserialization RCE via Pandas BuilderPublic exploithuggingface · datasets | High8.7 |
| CVE-2026-85670 | tokenizers BpeBuilder Buffer Overflow via merge tokenPublic exploithuggingface · tokenizers | High7.1 |
| CVE-2026-75104 | Hugging Face Transformers Path Traversal via Checkpoint IndexPublic exploithuggingface · transformers | Medium6.8 |
| CVE-2026-69112 | Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_mapPublic exploithuggingface · accelerate | Medium6.9 |
| CVE-2026-71281 | peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Moduleshuggingface · peft | High8.8 |
| CVE-2026-9856 | Path Traversal in huggingface/transformershuggingface · huggingface/transformers | High7.1 |
| CVE-2026-66007 | Datasets Path Traversal via Unsanitized file_name MetadataPublic exploithuggingface · datasets | Medium6.9 |
| CVE-2026-65010 | Datasets Symlink-following Arbitrary File Write via Extractor.extract()Public exploithuggingface · datasets | Medium4.4 |
| CVE-2026-65920 | Diffusers Path Traversal via weight_map Arbitrary File ReadPublic exploithuggingface · diffusers | Medium5.3 |
| CVE-2026-63086 | text-generation-inference 3.3.7 SSRF via fetch_image in multimodal chat completionsPublic exploithuggingface · text-generation-inference | Medium6.9 |
| CVE-2026-45804 | Diffusers: TOCTOU Trust Remote Code BypassPublic exploithuggingface · diffusers | High7.5 |
| CVE-2026-5241 | Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformersPublic exploithuggingface · huggingface/transformers | High8.0 |
| CVE-2026-4372 | Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformershuggingface · huggingface/transformers | High7.8 |
| CVE-2026-44827 | Diffusers: None.py Trust Remote Code BypassPublic exploithuggingface · diffusers | High8.8 |
| CVE-2026-44513 | Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom componentshuggingface · diffusers | High8.8 |
| CVE-2026-1839 | Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformersPublic exploithuggingface · huggingface/transformers | Medium6.5 |
| CVE-2026-4963 | huggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injectionPublic exploithuggingface · smolagents | Medium5.3 |
| CVE-2026-2654 | huggingface smolagents LocalPythonExecutor requests.post server-side request forgeryPublic exploithuggingface · smolagents | Medium5.3 |
| CVE-2026-0599 | Unbounded External Image Fetch in Validation Leads to Resource-Exhaustion DoS in huggingface/text-generation-inferencePublic exploithuggingface · huggingface/text-generation-inference | High7.5 |
| CVE-2025-11844 | XPath Injection in Hugging Face Smolagents search_item_ctrl_f FunctionPublic exploithuggingface · huggingface/smolagents | Medium5.4 |
| CVE-2025-6921 | Regular Expression Denial of Service (ReDoS) in huggingface/transformersPublic exploithuggingface · huggingface/transformers | Medium5.3 |
| CVE-2025-10772 | huggingface LeRobot ZeroMQ Socket lekiwi_remote.py missing authenticationPublic exploithuggingface · LeRobot | Medium5.3 |
| CVE-2025-6051 | Regular Expression Denial of Service (ReDoS) in huggingface/transformersPublic exploithuggingface · huggingface/transformers | Medium5.3 |
| CVE-2025-6638 | Regular Expression Denial of Service (ReDoS) in huggingface/transformersPublic exploithuggingface · huggingface/transformers | Medium5.3 |
| CVE-2025-5197 | Regular Expression Denial of Service (ReDoS) in huggingface/transformersPublic exploithuggingface · huggingface/transformers | Medium5.3 |
| CVE-2025-5120 | Sandbox Escape Vulnerability in huggingface/smolagentsPublic exploithuggingface · huggingface/smolagents | High7.6 |
| CVE-2025-3933 | Regular Expression Denial of Service (ReDoS) in huggingface/transformersPublic exploithuggingface · huggingface/transformers | Medium5.3 |
| CVE-2025-3777 | Improper Input Validation in huggingface/transformersPublic exploithuggingface · huggingface/transformers | Low3.5 |
| CVE-2025-3264 | Regular Expression Denial of Service (ReDoS) in huggingface/transformersPublic exploithuggingface · huggingface/transformers | Medium5.3 |
| CVE-2025-3263 | Regular Expression Denial of Service (ReDoS) in huggingface/transformersPublic exploithuggingface · huggingface/transformers | Medium5.3 |
| CVE-2025-3262 | Regular Expression Denial of Service (ReDoS) in huggingface/transformersPublic exploithuggingface · huggingface/transformers | Medium5.3 |
| CVE-2025-2099 | Regular Expression Denial of Service (ReDoS) in huggingface/transformersPublic exploithuggingface · huggingface/transformers | Medium5.3 |
| CVE-2025-1194 | Regular Expression Denial of Service (ReDoS) in huggingface/transformersPublic exploithuggingface · huggingface/transformers | Medium4.3 |
| CVE-2024-12720 | Regular Expression Denial of Service (ReDoS) in huggingface/transformersPublic exploithuggingface · huggingface/transformers | Medium5.3 |
| CVE-2024-3924 | Code Injection in huggingface/text-generation-inferencePublic exploithuggingface · huggingface/text-generation-inference | Medium4.4 |
| CVE-2024-3568 | Arbitrary Code Execution via Deserialization in huggingface/transformershuggingface · huggingface/transformers | Low3.4 |
| CVE-2023-7018 | Deserialization of Untrusted Data in huggingface/transformershuggingface · huggingface/transformers | Critical9.6 |
| CVE-2023-6730 | Deserialization of Untrusted Data in huggingface/transformershuggingface · huggingface/transformers | Critical9.0 |
| CVE-2023-2800 | Insecure Temporary File in huggingface/transformersPublic exploithuggingface · huggingface/transformers | Medium4.7 |