CVE-2026-126193

The Soup Sieve CSS selector library (versions 0.4 until 3.0 ) is vulnerable to uncontrolled recursion (CWE-674). Deeply nested CSS pseudo-class selectors can cause the recursive parser to exceed Python's recursion limit, triggering a RecursionError . Applications processing untrusted selectors ma...

CVE-2020-13756-env

CVE-2020-13756 Vulnerable Environment Vulnerable test environment for CVE-2020-13756 - Sabberworm PHP CSS Parser Remote Code Execution. Vulnerability Details Field| Value ---|--- CVE| CVE-2020-13756 Product| Sabberworm PHP CSS Parser Vulnerable Versions| getSelectorsBySpecificity' ' . $GET'n'; //...

SUSE CVE-2026-61847

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preservecomments option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a ve...

SUSE CVE-2026-61848

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...

CVE-2026-61848

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...

CVE-2026-61847

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preservecomments option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a ve...

CVE-2026-61846

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises...

CVE-2026-61845

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts CSS scientific notation number values with unbounded exponentiation before clamping the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS...

Linux Distros Unpatched Vulnerability : CVE-2026-61846

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses CSS simple blocks and...

Linux Distros Unpatched Vulnerability : CVE-2026-61848

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII...

Linux Distros Unpatched Vulnerability : CVE-2026-61845

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts CSS scientific notation number value...

Linux Distros Unpatched Vulnerability : CVE-2026-61847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preservecomments option is not enabled,...

CVE-2026-61846

A flaw was found in crass. The CSS parser is vulnerable to a Denial of Service DoS because it recursively processes simple blocks and functions without enforcing a depth limit. A remote attacker can supply a specially crafted CSS input containing deeply nested structures to trigger stack exhausti...

CVE-2026-61846

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises...

CVE-2026-61848

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...

CVE-2026-61847

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preservecomments option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a ve...

CVE-2026-61848

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...

CVE-2026-61846

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises...

CVE-2026-61847

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preservecomments option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a ve...

CVE-2026-61848 Crass: Non-ASCII characters cause superlinear CPU consumption

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...