Vulnerabilities
Summary — last 7 days
New vulnerabilities5,495▲ 2,247 vs. last week
Critical / high2,824▲ 1,268 vs. last week
New active exploitation (KEV)9▲ 4 vs. last week
Unscored (no CVSS)610▲ 401 vs. last week
65 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Analyzed | High (7.8) | 0.34% | — | Huggingface Transformers | 12/23/2025 | 6/17/2026 | Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a… | |
| Analyzed | High (7.8) | 0.34% | — | Huggingface Transformers | 12/23/2025 | 6/17/2026 | Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a… | |
| Analyzed | High (7.8) | 0.34% | — | Huggingface Transformers | 12/23/2025 | 6/17/2026 | Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a… | |
| Analyzed | High (7.8) | 0.33% | — | Huggingface Transformers | 12/23/2025 | 6/17/2026 | Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must… | |
| Analyzed | High (7.8) | 0.33% | — | Huggingface Transformers | 12/23/2025 | 6/17/2026 | Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the… | |
| Analyzed | High (7.8) | 0.36% | — | Huggingface Transformers | 12/23/2025 | 6/17/2026 | Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target… | |
| Analyzed | Low (2.8) | 0.16% | — | Entrinsik Informer | 12/17/2025 | 10/13/2026 | There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by entering an OTP code and new password then reviewing application responses. | |
| Deferred | Medium (5.4) | 0.16% | — | Merkulove Reformer FOR ElementorAI | 12/16/2025 | 10/5/2026 | Missing Authorization vulnerability in merkulove Reformer for Elementor reformer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reformer for Elementor: from n/a through <= 1.0.6. | |
| Deferred | High (8.8) | 0.66% | — | Nvidia Merlin Transformers4recAI | 12/9/2025 | 10/8/2026 | NVIDIA Merlin Transformers4Rec for Linux contains a vulnerability in the Trainer component, where a user could cause a deserialization issue. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering. | |
| Analyzed | High (7.5) | 0.51% | — | Huggingface Transformers | 9/23/2025 | 10/11/2026 | The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer. The vulnerability arises from the _do_use_weight_decay method, which processes user-controlled regular expressions in the include_in_weight_decay and… | |
| Analyzed | Medium (5.3) | 0.38% | — | Huggingface Transformers | 9/14/2025 | 9/30/2026 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the `EnglishNormalizer` class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises from the… | |
| Analyzed | High (7.5) | 0.53% | — | Huggingface Transformers | 9/12/2025 | 6/17/2026 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient… | |
| Deferred | High (7.8) | 0.77% | — | Nvidia Merlin Transformers4recAI | 8/13/2025 | 6/17/2026 | NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability in a python dependency, where an attacker could cause a code injection issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering. | |
| Analyzed | Medium (5.3) | 0.40% | — | Huggingface Transformers | 8/6/2025 | 6/17/2026 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt_weight_name()` function. This function, responsible for converting TensorFlow weight names to PyTorch format, uses a regex pattern `/[^/]*___([^/]*)/` that can… | |
| Analyzed | Medium (5.3) | 0.50% | — | Huggingface Transformers | 7/11/2025 | 6/17/2026 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the regex pattern… | |
| Analyzed | Low (3.5) | 0.41% | — | Huggingface Transformers | 7/7/2025 | 6/17/2026 | Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that… | |
| Analyzed | Medium (5.3) | 0.50% | — | Huggingface Transformers | 7/7/2025 | 6/17/2026 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within `dynamic_module_utils.py`. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular expression… | |
| Analyzed | Medium (5.3) | 0.50% | — | Huggingface Transformers | 7/7/2025 | 6/17/2026 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_configuration_file()` function within the `transformers.configuration_utils` module. The affected version is 4.49.0, and the issue is resolved in version 4.51.0. The… | |
| Analyzed | High (7.5) | 0.49% | — | Huggingface Transformers | 7/7/2025 | 6/17/2026 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains… | |
| Deferred | Critical (10) | 0.40% | — | Merkulove Reformer FOR ElementorAI | 6/17/2025 | 6/17/2026 | Unrestricted Upload of File with Dangerous Type vulnerability in merkulove Reformer for Elementor reformer-elementor allows Upload a Web Shell to a Web Server.This issue affects Reformer for Elementor: from n/a through <= 1.0.5. | |
| Analyzed | High (7.5) | 0.61% | — | Huggingface Transformers | 5/19/2025 | 6/17/2026 | A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to… | |
| Analyzed | Medium (6.5) | 0.48% | — | Huggingface Transformers | 4/29/2025 | 6/17/2026 | A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py` of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions process specially… | |
| Analyzed | High (7.5) | 0.75% | — | Huggingface Transformers | 3/20/2025 | 6/17/2026 | A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py. The vulnerability occurs in the post_process_single() function, where a regular expression processes specially crafted input. The issue stems from… | |
| Analyzed | High (8.8) | 2.6% | 💥 PoC | Huggingface Transformers | 11/22/2024 | 6/17/2026 | Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must… | |
| Analyzed | High (8.8) | 3.1% | 💥 PoC | Huggingface Transformers | 11/22/2024 | 6/17/2026 | Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target… |