HtmlUnit has 2 CVEs on record between 2023 and 2026. 1 was published in the last 90 days. The median CVSS is 8.5 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.5
- Publish → KEV
- —
- Last 90 days
- 1 prev 0
2
Total CVEs
1
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
HtmlUnit vulnerabilities
CVEs affecting HtmlUnit, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-104828High· 7.2HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-se…
▾ TwilightHtmlUnit · htmlunit-nekovia NVD
CVE-2023-26119Critical· 9.8Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.
Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.
▾ Midnighthtmlunit · htmlunitEPSS 2.5%via NVD