VU#456290: Hugging Face Transformers library writes remote code to disk prior to consent check
2026-09-01T20:52:02Z•6d9d364afd4766f82e134573452059719c89d0c77e6831873278e2d6c142b82f
CVE-2026-18412CVE-2026-19505CVE-2026-19506CVE-2026-19874CVE-2026-19912CVE-2026-19913CVE-2026-6726CVE-2026-6727CVE-2026-75501CVE-2026-80047CERT/CCHugging-Face-TransformersKalturaMetal-Gear-OnlineOpenCartRDK-BTPMUPnParbitrary-file-readarbitrary-file-writeauthentication-bypassbuffer-overflowcryptographydirectory-traversalinsecure-deserializationmemory-corruptionremote-code-executionroutervulnerability-notes
What happened
CERT/CC vulnerability notes describe multiple 2026 vulnerabilities across ML software, video platforms, gaming, residential routers, broadband gateway WebUIs, TPM implementations, e-commerce software, and font libraries. Impacts include unauthenticated administrative access, remote code execution, arbitrary file read/write, NAT/firewall bypass, memory corruption, cryptographic key compromise, and denial of service. The highest-risk issues include exposed unauthenticated router UPnP controls, RDK-B WebUI authentication bypass, Kaltura deserialization flaws, and remotely triggerable code-executে
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- 6d9d364afd4766f82e134573452059719c89d0c77e6831873278e2d6c142b82f
- Enrichment time
- 2026-09-01T20:52:02Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.