thymeleaf org.thymeleaf:thymeleaf-spring5

• CVE-2026-40478 Critical 9.1 Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf 1.1%
• CVE-2026-40477 Critical 9.1 Improper restriction of the scope of accessible objects in Thymeleaf expressions 0.9%