{"id":"CVE-2026-41901","aliases":["CLSA-2026-1784682981","CLSA-2026-1784856214","CLSA-2026-1788881357","CLSA-2026-1788887721","CLSA-2026-1789561134","CLSA-2026-1789577899","EUVD-2026-29872","GHSA-c9ph-gxww-7744","GHSA-r4v4-5mwr-2fwr","GHSA-xjw8-8c5c-9r79","RHLW-2026-e0e5640c50ceea84"],"status":"published","title":"Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions","description":"Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.","severity":{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00427,"percentile":0.37187,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-1336","CWE-917"],"published":"2026-05-04T21:15:20Z","modified":"2026-11-06T19:30:03Z","exploitation":[{"source":"euvd","since":"2026-10-10"}],"exploits":[{"source":"pocgithub","id":"HORKimhab/CVE-2026-41901","title":"HORKimhab/CVE-2026-41901","date":"2026-05-23","url":"https://github.com/HORKimhab/CVE-2026-41901"}],"fixes":[{"ecosystem":"Maven","package":"org.thymeleaf:thymeleaf","fixed_in":["3.1.5.RELEASE"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.thymeleaf:thymeleaf-spring5","fixed_in":["3.1.5.RELEASE"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.thymeleaf:thymeleaf-spring6","fixed_in":["3.1.5.RELEASE"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.thymeleaf:thymeleaf","fixed_in":["3.1.3.RELEASE-tuxcare.2","3.1.2.RELEASE-tuxcare.2"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.thymeleaf:thymeleaf-spring5","fixed_in":["3.1.3.RELEASE-tuxcare.2","3.1.2.RELEASE-tuxcare.2"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.thymeleaf:thymeleaf-spring6","fixed_in":["3.1.3.RELEASE-tuxcare.2","3.1.2.RELEASE-tuxcare.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.thymeleaf:thymeleaf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.4.RELEASE"},{"fixed":"3.1.5.RELEASE"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.thymeleaf:thymeleaf-spring5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.4.RELEASE"},{"fixed":"3.1.5.RELEASE"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.thymeleaf:thymeleaf-spring6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.4.RELEASE"},{"fixed":"3.1.5.RELEASE"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.thymeleaf:thymeleaf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.3.RELEASE"},{"fixed":"3.1.3.RELEASE-tuxcare.2"}]}],"versions":["3.1.3.RELEASE","3.1.3.RELEASE-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.thymeleaf:thymeleaf-spring5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.3.RELEASE"},{"fixed":"3.1.3.RELEASE-tuxcare.2"}]}],"versions":["3.1.3.RELEASE","3.1.3.RELEASE-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.thymeleaf:thymeleaf-spring6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.3.RELEASE"},{"fixed":"3.1.3.RELEASE-tuxcare.2"}]}],"versions":["3.1.3.RELEASE","3.1.3.RELEASE-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.thymeleaf:thymeleaf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2.RELEASE"},{"fixed":"3.1.2.RELEASE-tuxcare.2"}]}],"versions":["3.1.2.RELEASE","3.1.2.RELEASE-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.thymeleaf:thymeleaf-spring5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2.RELEASE"},{"fixed":"3.1.2.RELEASE-tuxcare.2"}]}],"versions":["3.1.2.RELEASE","3.1.2.RELEASE-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.thymeleaf:thymeleaf-spring6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2.RELEASE"},{"fixed":"3.1.2.RELEASE-tuxcare.2"}]}],"versions":["3.1.2.RELEASE","3.1.2.RELEASE-tuxcare.1"]},{"source":"osv","ecosystem":"Maven","package":"org.thymeleaf:thymeleaf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5.RELEASE"}]}],"versions":["1.0.0","1.0.0-beta1","1.0.0-beta2","1.0.0-beta3","1.0.0-beta4","1.0.0-beta5","1.0.1","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","2.0.0","2.0.0-beta1","2.0.0-beta2","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.18","2.0.19","2.0.2","2.0.20","2.0.21","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0-beta1","2.1.0-beta2","2.1.0-m1","2.1.0-m2","2.1.0-m3","2.1.0.RELEASE","2.1.1.RELEASE","2.1.2.RELEASE","2.1.3.RELEASE","2.1.4.RELEASE","2.1.5.RELEASE","2.1.6.RELEASE","3.0.0.ALPHA01","3.0.0.ALPHA02","3.0.0.ALPHA03","3.0.0.BETA01","3.0.0.BETA02","3.0.0.BETA03","3.0.0.RELEASE","3.0.1.RELEASE","3.0.10.RELEASE","3.0.11.RELEASE","3.0.12.RELEASE","3.0.13.RELEASE","3.0.14.RELEASE","3.0.15.RELEASE","3.0.2.RELEASE","3.0.3.RELEASE","3.0.4.RELEASE","3.0.5.RELEASE","3.0.6.RELEASE","3.0.7.RELEASE","3.0.8.RELEASE","3.0.9.RELEASE","3.1.0.M1","3.1.0.M2","3.1.0.M3","3.1.0.RC1","3.1.0.RC2","3.1.0.RELEASE","3.1.1.RELEASE","3.1.2.RELEASE","3.1.3.RELEASE","3.1.4.RELEASE","m1"]},{"source":"osv","ecosystem":"Maven","package":"org.thymeleaf:thymeleaf-spring5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5.RELEASE"}]}],"versions":["3.0.10.RELEASE","3.0.11.RELEASE","3.0.12.RELEASE","3.0.13.RELEASE","3.0.14.RELEASE","3.0.15.RELEASE","3.0.3.M1","3.0.4.M2","3.0.5.M3","3.0.6.M4","3.0.7.RC1","3.0.8.RELEASE","3.0.9.RELEASE","3.1.0.M1","3.1.0.M2","3.1.0.M3","3.1.0.RC1","3.1.0.RC2","3.1.0.RELEASE","3.1.1.RELEASE","3.1.2.RELEASE","3.1.3.RELEASE","3.1.4.RELEASE"]},{"source":"osv","ecosystem":"Maven","package":"org.thymeleaf:thymeleaf-spring6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5.RELEASE"}]}],"versions":["3.1.0.M1","3.1.0.M2","3.1.0.M3","3.1.0.RC1","3.1.0.RC2","3.1.0.RELEASE","3.1.1.RELEASE","3.1.2.RELEASE","3.1.3.RELEASE","3.1.4.RELEASE"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.thymeleaf:thymeleaf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15.RELEASE-rhlw-00009"}]}],"versions":["1.0.0","1.0.0-beta1","1.0.0-beta2","1.0.0-beta3","1.0.0-beta4","1.0.0-beta5","1.0.1","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","2.0.0","2.0.0-beta1","2.0.0-beta2","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.18","2.0.19","2.0.2","2.0.20","2.0.21","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0-beta1","2.1.0-beta2","2.1.0-m1","2.1.0-m2","2.1.0-m3","2.1.0.RELEASE","2.1.1.RELEASE","2.1.2.RELEASE","2.1.3.RELEASE","2.1.4.RELEASE","2.1.5.RELEASE","2.1.6.RELEASE","3.0.0.ALPHA01","3.0.0.ALPHA02","3.0.0.ALPHA03","3.0.0.BETA01","3.0.0.BETA02","3.0.0.BETA03","3.0.0.RELEASE","3.0.1.RELEASE","3.0.10.RELEASE","3.0.11.RELEASE","3.0.12.RELEASE","3.0.13.RELEASE","3.0.14.RELEASE","3.0.15.RELEASE","3.0.2.RELEASE","3.0.3.RELEASE","3.0.4.RELEASE","3.0.5.RELEASE","3.0.6.RELEASE","3.0.7.RELEASE","3.0.8.RELEASE","3.0.9.RELEASE","m1"],"bundled":3}],"products":[{"vendor":"thymeleaf","product":"thymeleaf"}],"references":[{"url":"https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-c9ph-gxww-7744","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41901","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c9ph-gxww-7744","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41901.json","tags":["advisory"]},{"url":"https://github.com/thymeleaf/thymeleaf","tags":["package"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40477.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21772","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40477","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40477.json","tags":["advisory"]},{"url":"https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-r4v4-5mwr-2fwr","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40477","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r4v4-5mwr-2fwr","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40478.json","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40478","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40478.json","tags":["advisory"]},{"url":"https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-xjw8-8c5c-9r79","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40478","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xjw8-8c5c-9r79","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-41901","title":"Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions","description":"Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.","status":"published","published":"2026-05-12T22:35:50.617Z","modified":"2026-05-13T12:08:38.767Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-917","CWE-1336"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-29872","description":"Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.","status":"published","published":"2026-05-12T22:35:50Z","modified":"2026-05-13T12:08:38Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2026-10-10","updated_at":"2026-11-02T19:04:34.274348Z"}],"ghsa":[{"id":"GHSA-c9ph-gxww-7744","title":"Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns","description":"### Impact\n\nA security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.4.RELEASE. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI).\n\n### Patches\n\nThis has been fixed in Thymeleaf 3.1.5.RELEASE. All users are advised to upgrade immediately.\n\n### Workarounds\n\nNo workaround is available beyond ensuring applications do not pass unvalidated/unsanitized data directly to the template engine. Upgrading to 3.1.5.RELEASE is strongly recommended in any case.","status":"published","published":"2026-05-04T21:15:20Z","modified":"2026-05-13T16:43:38Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-917","CWE-1336"],"updated_at":"2026-11-02T14:40:09.033429Z"}],"nvd":[{"id":"CVE-2026-41901","description":"Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.","status":"published","published":"2026-05-12T23:16:17.06Z","modified":"2026-06-17T10:47:09.893Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-917","CWE-1336"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"CVE-2026-41901","title":"Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions","description":"Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.","status":"published","published":"2026-05-12T22:35:50.617Z","modified":"2026-10-28T02:31:00.730841743Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1336","CWE-917"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"GHSA-c9ph-gxww-7744","title":"Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns","description":"### Impact\n\nA security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.4.RELEASE. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI).\n\n### Patches\n\nThis has been fixed in Thymeleaf 3.1.5.RELEASE. All users are advised to upgrade immediately.\n\n### Workarounds\n\nNo workaround is available beyond ensuring applications do not pass unvalidated/unsanitized data directly to the template engine. Upgrading to 3.1.5.RELEASE is strongly recommended in any case.","status":"published","published":"2026-05-04T21:15:20Z","modified":"2026-05-13T17:02:46.716315Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1336","CWE-917"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"RHLW-2026-e0e5640c50ceea84","title":"Lightwell Security Advisory: thymeleaf 3.0.15.RELEASE-rhlw-00009","description":"Red Hat Lightwell has released org.thymeleaf:thymeleaf 3.0.15.RELEASE-rhlw-00009 with backported fixes for CVE-2026-40477, CVE-2026-40478, and CVE-2026-41901.\n\nCVE-2026-40477: Improper restriction of the scope of accessible objects in Thymeleaf expressions\n\nCVE-2026-40478: Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf\n\nCVE-2026-41901: Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions\n\nThis patched artifact is a drop-in replacement for org.thymeleaf:thymeleaf 3.0.15.RELEASE-rhlw-00009 from Maven Central.","status":"published","published":"2026-10-21T19:19:23Z","modified":"2026-11-06T19:30:03.870744546Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-06T19:35:45.633414Z"},{"id":"CLSA-2026-1784682981","title":"TuxCare security update for org.thymeleaf:thymeleaf (1 CVE)","description":"TuxCare rebuilt org.thymeleaf:thymeleaf to address 1 CVE. Fixed in 3.1.2.RELEASE-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:46Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784856214","title":"TuxCare security update for org.thymeleaf (1 CVE)","description":"TuxCare rebuilt 3 org.thymeleaf packages to address 1 CVE. Fixed in 3.1.3.RELEASE-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:48Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1788881357","title":"TuxCare security update for org.thymeleaf:thymeleaf (1 CVE)","description":"TuxCare rebuilt org.thymeleaf:thymeleaf to address 1 CVE. Fixed in 3.1.3.RELEASE-tuxcare.2.","status":"published","published":"2026-09-08T15:29:17Z","modified":"2026-10-15T09:47:42.634551841Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1788887721","title":"TuxCare security update for org.thymeleaf (1 CVE)","description":"TuxCare rebuilt 2 org.thymeleaf packages to address 1 CVE. Fixed in 3.1.3.RELEASE-tuxcare.2.","status":"published","published":"2026-09-08T17:15:21Z","modified":"2026-11-02T19:46:14.510397537Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1789561134","title":"TuxCare security update for org.thymeleaf:thymeleaf (1 CVE)","description":"TuxCare rebuilt org.thymeleaf:thymeleaf to address 1 CVE. Fixed in 3.1.2.RELEASE-tuxcare.2.","status":"published","published":"2026-09-16T12:18:54Z","modified":"2026-10-15T09:47:43.824899786Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789577899","title":"TuxCare security update for org.thymeleaf (1 CVE)","description":"TuxCare rebuilt 2 org.thymeleaf packages to address 1 CVE. Fixed in 3.1.2.RELEASE-tuxcare.2.","status":"published","published":"2026-09-16T16:58:19Z","modified":"2026-11-02T19:46:17.780983027Z","updated_at":"2026-11-02T20:29:33.792105Z"}]}}