org.thymeleaf:thymeleaf-spring6 (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.thymeleaf:thymeleaf-spring6, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (3)

• CVE-2026-40477 — CVSS 9.0 (critical): Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security…
• CVE-2026-40478 — CVSS 9.0 (critical): Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security…
• CVE-2026-41901 — CVSS 9.0 (critical): Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass…