thymeleaf thymeleaf

• CVE-2026-41901 Critical 9.0 Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions 0.4%
• CVE-2026-40478 Critical 9.1 Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf 1.1%
• CVE-2026-40477 Critical 9.1 Improper restriction of the scope of accessible objects in Thymeleaf expressions 0.9%