TH
Vendor
thymeleaf
9
CVEs
0
On KEV
0
New 30D
Products
TH9.8
thymeleaf
thymeleaf
5 CVEs0 on KEV0 new
OR9.0
org.thymeleaf:thymeleaf-spring5
thymeleaf
2 CVEs0 on KEV0 new
OR9.0
org.thymeleaf:thymeleaf-spring6
thymeleaf
2 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-41901 | TH thymeleaf thymeleaf | 9.0 | May 12 | Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions |
| CVE-2026-40478 | TH thymeleaf thymeleaf | 9.0 | Apr 17 | Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf |
| CVE-2026-40477 | OR org.thymeleaf:thymeleaf-spring5 thymeleaf | 9.0 | Apr 17 | Improper restriction of the scope of accessible objects in Thymeleaf expressions |
| CVE-2023-38286 | TH Thymeleaf Thymeleaf | 7.5 | Jul 14 | Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML |
| CVE-2021-43466 | TH Thymeleaf Thymeleaf | 9.8 | Nov 9 | In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution |