Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution

Spring Cloud Netflix Hystrix Dashboard prior to version 2.2.10 is susceptible to remote code execution. Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view...

thymeleaf-check

thymeleaf-check ThymeleafCVE-2026-40477 / CVE-2026-41901 offline triage tool — zero dependencies, single jar, no network. Two CVSS 9.0 SSTI bypasses, with two fixed releases shipped within nine days. It first answers "which of these am I affected by," then answers the harder question: On my versi...

RHLW-2026-E0E5640C50CEEA84 Lightwell Security Advisory: thymeleaf 3.0.15.RELEASE-rhlw-00009

Red Hat Lightwell has released org.thymeleaf:thymeleaf 3.0.15.RELEASE-rhlw-00009 with backported fixes for CVE-2026-40477, CVE-2026-40478, and CVE-2026-41901. CVE-2026-40477: Improper restriction of the scope of accessible objects in Thymeleaf expressions CVE-2026-40478: Improper neutralization o...

CLSA-2026-1789561134 TuxCare security update for org.thymeleaf:thymeleaf (1 CVE)

TuxCare rebuilt org.thymeleaf:thymeleaf to address 1 CVE. Fixed in 3.1.2.RELEASE-tuxcare.2...

RHLW-2026-81384C14BC892E51 Lightwell Security Advisory: thymeleaf 3.0.15.RELEASE-rhlw-00003

Red Hat Lightwell has released org.thymeleaf:thymeleaf 3.0.15.RELEASE-rhlw-00003 with a backported security fix. CVE-2023-38286: Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may b...

CLSA-2026-1788881357 TuxCare security update for org.thymeleaf:thymeleaf (1 CVE)

TuxCare rebuilt org.thymeleaf:thymeleaf to address 1 CVE. Fixed in 3.1.3.RELEASE-tuxcare.2...

CLSA-2026-1784856214 TuxCare security update for org.thymeleaf (1 CVE)

TuxCare rebuilt 3 org.thymeleaf packages to address 1 CVE. Fixed in 3.1.3.RELEASE-tuxcare.1...

CLSA-2026-1784682981 TuxCare security update for org.thymeleaf:thymeleaf (1 CVE)

TuxCare rebuilt org.thymeleaf:thymeleaf to address 1 CVE. Fixed in 3.1.2.RELEASE-tuxcare.1...

CLSA-2025-1752019357 TuxCare security update for org.thymeleaf:thymeleaf (1 CVE)

TuxCare rebuilt org.thymeleaf:thymeleaf to address 1 CVE. Fixed in 3.0.15.RELEASE.tuxcare.1...

Thymeleaf Expression Language XSS

The vulnerability of the JavaScript-based Thymeleaf engine is related to the lack of measures taken to neutralize special elements used in the expression language operator. Exploiting this vulnerability can allow a remote attacker to bypass existing security mechanisms...

org.http4k:http4k-aws (2.10.0), org.http4k:http4k-client-apache (2.10.0) +4 more potentially affected by unknown CVE via org.http4k:http4k-core (2.10.0)

org.http4k:http4k-core MAVEN version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.10.0 - org.http4k:http4k-client-apache 2.10.0 - org.http4k:http4k-contract 2.10.0 -...

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') (CVE-2026-40477, CVE-2026-40478)

Summary There are vulnerabilities in thymeleaf-3.1.2.RELEASE.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-40477, CVE-2026-40478. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-40477 DESCRIPTION: Thymeleaf is a server-side Java template engine...

CVE-2026-41901

A flaw was found in Thymeleaf, a server-side Java template engine. A security bypass vulnerability exists in its expression execution mechanisms, allowing specific constructs to be executed even in restricted sandboxed contexts. If an application developer passes unsanitized variables containing...

Thymeleaf SSTI

The vulnerability of the JavaScript-based Thymeleaf framework is related to the lack of measures taken to neutralize special elements used in the expression language operator. Exploiting this vulnerability can allow a remote attacker to execute a Server Side Template Injection SSTI attack...

CVE-2026-41901

Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous...

CVE-2026-41901

Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24) +3348 more potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (>=m1, <=3.1.4.release)

org.thymeleaf:thymeleaf MAVEN version =m1, =0.5.0, =1.0.0, =0.9.6, =0.9.6, =1.0.0, =0.0.1, =1.0.0, =1.0, =3.4.0, =5.6.5, =7.4.5 and more Source cves: CVE-2026-41901 Source advisory: MEND:CVE-2026-41901...

CVE-2026-41901

Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous...

CVE-2026-41901 Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions

Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous...

CVE-2026-41901

CVE-2026-41901 (Thymeleaf) describes a security bypass in the expression execution mechanisms of Thymeleaf prior to 3.1.5.RELEASE. In sandboxed contexts, unsanitized variables containing certain expressions could be executed, enabling Server-Side Template Injection (SSTI). The issue is fixed in 3...