org.thymeleaf:thymeleaf-spring3 (2.1.0-m3) potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (2.1.0-m3)

org.thymeleaf:thymeleaf MAVEN version 2.1.0-m3 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.1.0-m3 Source cves: CVE-2026-40478 Source advisory: OSV:GHSA-XJW8-8C5C-9R79...

org.broadleafcommerce:broadleaf-common (>=3.0.11-ga, <=3.0.16-ga), org.broadleafcommerce:broadleaf-contentmanagement-module (>=3.0.11-ga, <=3.0.16-ga) +8 more potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (2.0.20)

org.thymeleaf:thymeleaf MAVEN version 2.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.broadleafcommerce:broadleaf-common =3.0.11-ga, =3.0.11-ga, =3.0.11-ga, =3.0.11-ga, =3.0.11-ga, =2.0.8, =2.0....

com.github.dandelion:dandelion-thymeleaf (>=0.2.0, <=0.2.1), com.github.dandelion:datatables-thymeleaf (>=0.8.8, <=0.8.14) +6 more potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (2.0.16)

org.thymeleaf:thymeleaf MAVEN version 2.0.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - com.github.dandelion:dandelion-thymeleaf =0.2.0, =0.8.8, =0.2.1, =1.0.0, =0.0.1, =2.0.0-beta1, =2.0.7 Source cve...

Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of...

GHSA-XJW8-8C5C-9R79 Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of...

com.connect-group:thymesheet (2.1.0-beta2), net.sourceforge.html5valdialect:html5valdialect (>=2.1.0, <=2.1.2) +6 more potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (2.1.0-beta2)

org.thymeleaf:thymeleaf MAVEN version 2.1.0-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - com.connect-group:thymesheet 2.1.0-beta2 - net.sourceforge.html5valdialect:html5valdialect =2.1.0, =2.1.0,...

org.thymeleaf.extras:thymeleaf-extras-tiles2 (1.0.0-beta2), org.thymeleaf:thymeleaf-spring3 (2.0.12) potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (2.0.12)

org.thymeleaf:thymeleaf MAVEN version 2.0.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf.extras:thymeleaf-extras-tiles2 1.0.0-beta2 - org.thymeleaf:thymeleaf-spring3 2.0.12 Source cves:...

org.thymeleaf:thymeleaf-spring3 (1.0.0) potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (1.0.0)

org.thymeleaf:thymeleaf MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.0.0 Source cves: CVE-2026-40478 Source advisory: OSV:GHSA-XJW8-8C5C-9R79...

org.thymeleaf:thymeleaf-spring3 (2.0.0-beta2) potentially affected by CVE-2026-40477 via org.thymeleaf:thymeleaf (2.0.0-beta2)

org.thymeleaf:thymeleaf MAVEN version 2.0.0-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.0.0-beta2 Source cves: CVE-2026-40477 Source advisory:...

org.thymeleaf:thymeleaf-spring3 (1.1.5) potentially affected by CVE-2026-40477 via org.thymeleaf:thymeleaf (1.1.5)

org.thymeleaf:thymeleaf MAVEN version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.1.5 Source cves: CVE-2026-40477 Source advisory: OSV:GHSA-R4V4-5MWR-2FWR...

org.thymeleaf:thymeleaf-spring3 (2.0.3) potentially affected by CVE-2026-40477 via org.thymeleaf:thymeleaf (2.0.3)

org.thymeleaf:thymeleaf MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.0.3 Source cves: CVE-2026-40477 Source advisory: OSV:GHSA-R4V4-5MWR-2FWR...

org.broadleafcommerce:broadleaf-common (>=3.0.11-ga, <=3.0.16-ga), org.broadleafcommerce:broadleaf-contentmanagement-module (>=3.0.11-ga, <=3.0.16-ga) +8 more potentially affected by CVE-2026-40477 via org.thymeleaf:thymeleaf (2.0.20)

org.thymeleaf:thymeleaf MAVEN version 2.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.broadleafcommerce:broadleaf-common =3.0.11-ga, =3.0.11-ga, =3.0.11-ga, =3.0.11-ga, =3.0.11-ga, =2.0.8, =2.0....

nz.net.ultraq.web.thymeleaf:thymeleaf-layout-dialect (1.0.3), org.thymeleaf:thymeleaf-spring3 (2.0.11) potentially affected by CVE-2026-40477 via org.thymeleaf:thymeleaf (2.0.11)

org.thymeleaf:thymeleaf MAVEN version 2.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - nz.net.ultraq.web.thymeleaf:thymeleaf-layout-dialect 1.0.3 - org.thymeleaf:thymeleaf-spring3 2.0.11 Source cves:...

org.thymeleaf:thymeleaf-spring3 (2.0.0-beta1) potentially affected by CVE-2026-40477 via org.thymeleaf:thymeleaf (2.0.0-beta1)

org.thymeleaf:thymeleaf MAVEN version 2.0.0-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.0.0-beta1 Source cves: CVE-2026-40477 Source advisory:...

com.datasift.client:datasift-java (>=3.0.0-beta1, <=3.1.0), com.github.dandelion:dandelion-thymeleaf (0.1.0) +20 more potentially affected by CVE-2026-40477 via org.thymeleaf:thymeleaf (2.0.15)

org.thymeleaf:thymeleaf MAVEN version 2.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - com.datasift.client:datasift-java =3.0.0-beta1, =0.8.4, =0.8.1, =1.1, =4.0.0, =0.0.1, =0.0.9, =0.0.1, =1.0.5,...

org.thymeleaf:thymeleaf-spring3 (1.0.0-beta2) potentially affected by CVE-2026-40477 via org.thymeleaf:thymeleaf (1.0.0-beta2)

org.thymeleaf:thymeleaf MAVEN version 1.0.0-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.0.0-beta2 Source cves: CVE-2026-40477 Source advisory:...

org.thymeleaf:thymeleaf-spring3 (1.0.0-beta4) potentially affected by CVE-2026-40477 via org.thymeleaf:thymeleaf (1.0.0-beta4)

org.thymeleaf:thymeleaf MAVEN version 1.0.0-beta4 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.0.0-beta4 Source cves: CVE-2026-40477 Source advisory:...

org.thymeleaf.extras:thymeleaf-extras-conditionalcomments (2.1.0-beta1), org.thymeleaf.extras:thymeleaf-extras-springsecurity3 (2.1.0-beta1) +3 more potentially affected by CVE-2026-40477 via org.thymeleaf:thymeleaf (2.1.0-beta1)

org.thymeleaf:thymeleaf MAVEN version 2.1.0-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf.extras:thymeleaf-extras-conditionalcomments 2.1.0-beta1 -...

org.thymeleaf:thymeleaf-spring3 (m1) potentially affected by CVE-2026-40477 via org.thymeleaf:thymeleaf (m1)

org.thymeleaf:thymeleaf MAVEN version m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 m1 Source cves: CVE-2026-40477 Source advisory: OSV:GHSA-R4V4-5MWR-2FWR...

Improper restriction of the scope of accessible objects in Thymeleaf expressions

Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potential...