huggingface

Records15

1. closed
   Hugging Face libraries Hugging Face malware campaign returns to hijack GPUs

   Supply chain · Exploited · —No fix needed · since 29 Oct 2026

   AI
2. closed
   GPT-5.6 Sol Autonomous OpenAI Evaluation Agents Compromise Hugging Face Infrastructure

   Breaches & attacks · Exploited · since 8 Jul 2026

   AI
3. closed6.8
   Hugging Face libraries CVE-2026-75104: Hugging Face Transformers vulnerable to arbitrary file read

   Patch now · Disclosed · since 17 Aug 2026 · CVE-2026-75104

   AI
4. closed
   Hugging Face libraries Model Namespace Reuse AI Supply Chain Attack

   Research · since 3 Sep 2025

   AI
5. closed6.5
   Hugging Face libraries CVE-2026-1839: HuggingFace Transformers Arbitrary Code Execution in Trainer

   Patch now · Disclosed · since 7 Apr 2026 · CVE-2026-1839

   AI
6. closed7.8
   Hugging Face libraries CVE-2025-14929: Hugging Face Transformers Deserialization Vulnerability

   Patch now · Disclosed · since 23 Dec 2025 · CVE-2025-14929

   AI
7. closed7.8
   Hugging Face libraries CVE-2025-14926: Hugging Face Transformers Code Injection Vulnerability

   Patch now · Disclosed · since 23 Dec 2025 · CVE-2025-14926

   AI
8. closed5.3
   Hugging Face libraries CVE-2025-6921: Hugging Face Transformers vulnerable to ReDoS in optimizer

   Patch now · Disclosed · since 23 Sep 2025 · CVE-2025-6921

   AI
9. closed5.3
   Hugging Face libraries CVE-2025-6051: ReDoS vulnerability in Hugging Face Transformers EnglishNormalizer

   Patch now · Disclosed · since 14 Sep 2025 · CVE-2025-6051

   AI
10. closed5.3
    Hugging Face libraries CVE-2025-5197: Hugging Face Transformers ReDoS Vulnerability

    Patch now · Disclosed · since 6 Aug 2025 · CVE-2025-5197

    AI
11. closed5.3
    Hugging Face libraries CVE-2025-2099: Hugging Face Transformers Regular Expression Denial of Service

    Patch now · Disclosed · since 19 May 2025 · CVE-2025-2099

    AI
12. closed
    Hugging Face libraries Malicious Models with Embedded Malware Discovered on Hugging Face

    Supply chain · Exploited · since 2025 (approx.)

    AI
13. closed
    Hugging Face libraries Organization Impersonation and Model Poisoning on Hugging Face

    Research · since 23 Aug 2023

    AI
14. closed5.3
    Hugging Face libraries CVE-2024-12720: Transformers ReDoS Vulnerability

    Patch now · Disclosed · since 20 Mar 2025 · CVE-2024-12720

    AI
15. closed
    Hugging Face libraries PoisonGPT Open Source Model Supply Chain Demonstration

    Research · since Jul 2023 (approx.)

    AI