CVE-2026-40478 Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly...

XWiki Platform XSS

The vulnerability of the XWiki Platform lies in the lack of measures taken to neutralize the XSS alternative syntax. Exploiting this vulnerability allows a malicious actor to substitute the displayed URL with another value...