Login Request a demo
CO
Product
compliance-trestle
by oscal-compass · last CVE Aug 25, 2026
9
CVEs
0
On KEV
8.6
Max CVSS
0
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 0High 7Medium 2Low 0
Severity
All severities9Critical0High7Medium2Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add compliance-trestle to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-52776
8.6
0%
Aug 25
Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
Affected: < 3.12.4; >= 4.0.0, < 4.1.0
CVE-2026-46345
8.4
0%
Aug 17
compliance-trestle - jinja has an Arbitrary File Write via Path Traversal
Affected: >= 4.0.0, < 4.0.3; < 3.12.2
CVE-2026-57170
7.8
0%
Aug 25
Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
Affected: < 3.12.4; >= 4.0.0, < 4.1.0
CVE-2026-54757
7.8
0%
Aug 25
Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
Affected: < 3.12.4; >= 4.0.0, < 4.1.0
CVE-2026-46439
7.8
0%
Aug 14
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
Affected: < 3.12.2; >= 4.0.0, < 4.0.3
CVE-2026-57171
7.7
0%
Aug 25
Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
Affected: < 3.12.4; >= 4.0.0, < 4.1.0
CVE-2026-45725
7.1
0%
Aug 13
compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal
Affected: < 3.12.2; >= 4.0.0, < 4.0.3
CVE-2026-45774
6.9
1%
Aug 13
compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal
Affected: < 3.12.2; >= 4.0.0, < 4.0.3
CVE-2026-46380
6.7
0%
Aug 14
compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem
Affected: >= 4.0.0, < 4.0.3; < 3.12.2
Showing 9