CVE-2026-40478Critical· 9.0▾ MidnightThymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mecha…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 49.5 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.8%
0.8% → 1.2%
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
thymeleaf < 3.1.4Upgrade past the affected range:
thymeleaf 3.1.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-40477Critical· 9.0Thymeleaf is a server-side Java template engine for web and standalone environments
CVE-2026-78164High· 8.2org.apache.camel/camel-http-common: org.apache.camel/camel-http: org.apache.camel/camel-vertx-http: org.apache.camel/camel-undertow: org.ap…
CVE-2026-57170High· 7.8Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents
CVE-2026-46439High· 7.8compliance-trestle is a tooling platform for managing compliance as code
CVE-2026-115223Medium· 4.9Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block
CVE-2026-27641Critical· 9.8Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection