Skip to content
OpenAdvisories

Product · thymeleaf

org.thymeleaf:thymeleaf-spring6

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-40477 Exploited Public exploit

    Improper restriction of the scope of accessible objects in Thymeleaf expressions

    Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expressio…

    thymeleaf thymeleaf org.thymeleaf:thymeleaf-spring5 org.thymeleaf:thymeleaf-spring6 Maven