org.thymeleaf:thymeleaf-spring6 vulnerabilities (Maven)

3 vulnerabilities.

• org.thymeleaf:thymeleaf-spring6 Maven Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions CVE-2026-41901 Known exploitedPublic exploitFix available 9.0 CriticalMay 4, 2026
• org.thymeleaf:thymeleaf-spring6 Maven Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf CVE-2026-40478 Known exploitedFix available 9.1 CriticalApril 15, 2026
• org.thymeleaf:thymeleaf-spring6 Maven Improper restriction of the scope of accessible objects in Thymeleaf expressions CVE-2026-40477 Known exploitedPublic exploitFix available 9.1 CriticalApril 15, 2026