Skip to content

CyberSIXT Search

Vendor

Hugging Face

No Hugging Face CVE is in the CISA KEV catalogue.

Tracked since 28 Apr · latest article Wed 2 Sep · RSS

Open KEV deadlines: 0; None open
Added to KEV · 90 days: 0; of 0 all time
High exploit odds: 1; ≥ p95, not in KEV
Articles · 7 days: 0; usual rate

Exploited, by due date

No Hugging Face CVE is in the CISA KEV catalogue.

Products

2 products · 2 CVEs in coverage

Transformers1 CVEs · 0 in KEVlatest 2 Sep LeRobot1 CVEs · 0 in KEVlatest 28 Apr

Coverage

2 articles · all timeFull timeline →

Two articles so far, 28 Apr to 2 Sep.

Tue 28 Apr · first reportCritical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCEThe Hacker News
Wed 2 SepCVE-2026-80047: Hugging Face Transformers Library VulnerabilitySecurityOnline

See the full timeline

2 SepCVE-2026-80047: Hugging Face Transformers Library VulnerabilitySecurityOnline
28 AprCritical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCEThe Hacker News

All CVEs in coverage

2

CVE-2026-25874LeRobot Unsafe Deserialization Remote Code Execution via gRPCCVSS9.3Critical–Not in KEV16%EPSS1article

CVE-2026-80047Hugging Face Transformers library writes remote code to disk prior to consent checkCVSS7.8High–Not in KEV0.1%EPSS1article

How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

High exploit odds means FIRST EPSS percentile ≥ 95, excluding entries in CISA KEV.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.