Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)
2mo agoen
Source
SnykDon't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)snyk.ioCVE-2026-40478: The Thymeleaf template injection (CVSS 9.1) is conditional. Patch to 3.1.4+ immediately, and audit your code for dynamic view or template expression misuse, which is the key precondition for exploitability.
You might also wanna read
WAF - WAF Release - 2025-10-13
Cloudflare·8mo ago
CVE-2025-14773: Cross-Site Scripting Vulnerability in ABB T-MAC Plus (Version 4.0-24)
A cross-site scripting (XSS) vulnerability has been disclosed in ABB T-MAC Plus, affecting version 4.0-24. The vulnerability involves improp
nvd.nist.gov·1mo ago
CVE-2026-48800 Bypass: Path Traversal Vulnerability Discovered in Notepad++ v8.9.6.1
A security vulnerability (CVE-2026-48800 bypass) has been discovered in Notepad++ v8.9.6.1, the latest patched version. The vulnerability in
github.com·28d ago
Analysis of CVE-2025-14986: Temporal's Masked Namespace Vulnerability Enabling Cross-Tenant Security Bypass
The article details CVE-2025-14986, a security vulnerability in Temporal's ExecuteMultiOperation endpoint that allows cross-tenant policy an
depthfirst.com·5mo agoCVE-2026-11462: Improper Authorization Vulnerability in BeikeShop Stripe Plugin (Up to v1.6.0.22)
A security vulnerability (CVE-2026-11462) has been discovered in Chengdu Everbrite Network Technology's BeikeShop e-commerce platform up to
nvd.nist.gov·1mo ago
Broadcom Discloses Three Stored XSS Vulnerabilities in VMware Cloud Foundation Operations
Broadcom disclosed three stored cross-site scripting (XSS) vulnerabilities (CVE-2026-41722, CVE-2026-41723, CVE-2026-41724) affecting VMware
cybersecuritynews.com·1mo ago
Comments
Sign in to join the conversation.
No comments yet. Be the first.