W3C
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| CSS Validator | 1 | – | Mar 28, 2025 |
| Unicorn | 1 | – | Dec 29, 2022 |
| websub | 1 | – | Oct 27, 2026 |
Exploited and recent CVEs
- CVE-2026-50571 WebSub: Reflected script execution through intent-verification challenges 0.2%
- CVE-2025-1781 There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request forgery (SSRF). This could be exploited to 0.4%
- CVE-2021-4296 w3c Unicorn ValidatorNuMessage.java ValidatorNuMessage cross site scripting 0.6%