Product by Facelessuser
Soupsieve
9 known vulnerabilities in Soupsieve (Facelessuser), 0 of them actively exploited (CISA KEV).
Key figures
9
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-49477 | Soup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector Parser | 7.5 | |
| High | CVE-2026-49476 | Soup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve | 7.5 | |
| Medium | CVE-2026-85999 | Facelessuser Soupsieve: Inefficient Regular Expression Complexity | 5.3 | |
| Medium | CVE-2026-86000 | Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns | 5.3 | |
| High | CVE-2026-126191 | Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER | 7.5 | |
| High | CVE-2026-126190 | Soup Sieve: Polynomial-time denial of service in the descendant combinator | 7.5 | |
| Medium | CVE-2026-126192 | Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time | — | |
| Medium | CVE-2026-126189 | Soup Sieve: Quadratic-time denial of service when matching `:has()` | 5.3 | |
| Medium | CVE-2026-126193 | Facelessuser Soupsieve: Uncontrolled Recursion | 5.3 |