Login Request a demo
TH
Product
thymeleaf
by thymeleaf · last CVE May 12, 2026
5
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities5In the news0Timeline
Severity mix
Critical 4High 1Medium 0Low 0
Severity
All severities5Critical4High1Medium0Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add thymeleaf to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-43466
9.8
4%
Nov 9
In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution
Affected: 3.0.12
CVE-2026-41901
9.0
0%
May 12
Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions
Affected: < 3.1.5.RELEASE
CVE-2026-40478
9.0
1%
Apr 17
Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf
Affected: < 3.1.4.RELEASE
CVE-2026-40477
9.0
1%
Apr 17
Improper restriction of the scope of accessible objects in Thymeleaf expressions
Affected: < 3.1.4.RELEASE
CVE-2023-38286
7.5
1%
Jul 14
Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML
Affected: through 3.1.1
Showing 5