Vendors / thymeleaf Records 5 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 4
CVSS high 1
Exploited now thymeleaf records in CISA KEV No thymeleaf vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 68
Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML.
CVSS 3.1 HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00966 · Published 2023-07-14 · Fixed in 3.1.2, 2.7.16 CWE-77
Priority MEDIUM 49
In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03993 · Published 2021-11-09 · Fixed in 3.0.13.RELEASE CWE-94
Priority MEDIUM 43
Thymeleaf is a server-side Java template engine for web and standalone environments.
CVSS 3.1 CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01102 · Published 2026-04-17 · Partial fix · 3.1.4.RELEASE CWE-1336
Priority MEDIUM 43
Thymeleaf is a server-side Java template engine for web and standalone environments.
CVSS 3.1 CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00851 · Published 2026-04-17 · Partial fix · 3.1.4.RELEASE CWE-1336
Open these records in search → All records by CVSS severity
4 1 0 0 0
