Vendor
Facelessuser
14 known vulnerabilities in products by Facelessuser, 0 of them actively exploited (CISA KEV).
Key figures
14
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2023-32309 | Arbitrary file inclusion with the pymdowm-snippets extension | 7.5 | |
| High | CVE-2026-67422 | Facelessuser Pymdown-extensions: Inefficient Regular Expression Complexity | 7.5 | |
| High | CVE-2026-49477 | Soup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector Parser | 7.5 | |
| High | CVE-2026-49476 | Soup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve | 7.5 | |
| Medium | CVE-2026-85999 | Facelessuser Soupsieve: Inefficient Regular Expression Complexity | 5.3 | |
| Medium | CVE-2026-86000 | Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns | 5.3 | |
| High | CVE-2026-126191 | Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER | 7.5 | |
| High | CVE-2026-126190 | Soup Sieve: Polynomial-time denial of service in the descendant combinator | 7.5 | |
| Medium | CVE-2026-126192 | Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time | — | |
| Medium | CVE-2026-61632 | PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path | 5.3 | |
| Medium | CVE-2026-126189 | Soup Sieve: Quadratic-time denial of service when matching `:has()` | 5.3 | |
| Medium | CVE-2026-126193 | Facelessuser Soupsieve: Uncontrolled Recursion | 5.3 | |
| Medium | CVE-2025-68142 | PyMdown Extensions has ReDOS bug in Figure Capture extension | 5.3 | |
| Medium | CVE-2026-46338 | Facelessuser Pymdown-extensions: Path Traversal | 4.3 |
Products
| Soupsieve | 9 | 0 |
| Pymdown-extensions | 8 | 0 |