OS
Vendor
oscal-compass
9
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-57171 | CO compliance-trestle oscal-compass | 7.7 | Aug 25 | Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345) |
| CVE-2026-57170 | CO compliance-trestle oscal-compass | 7.8 | Aug 25 | Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439) |
| CVE-2026-52776 | CO compliance-trestle oscal-compass | 8.6 | Aug 25 | Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0 |
| CVE-2026-54757 | CO compliance-trestle oscal-compass | 7.8 | Aug 25 | Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data |
| CVE-2026-46345 | CO compliance-trestle oscal-compass | 8.4 | Aug 17 | compliance-trestle - jinja has an Arbitrary File Write via Path Traversal |
| CVE-2026-46380 | CO compliance-trestle oscal-compass | 6.7 | Aug 14 | compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem |
| CVE-2026-46439 | CO compliance-trestle oscal-compass | 7.8 | Aug 14 | compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI) |
| CVE-2026-45774 | CO compliance-trestle oscal-compass | 6.9 | Aug 13 | compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal |
| CVE-2026-45725 | CO compliance-trestle oscal-compass | 7.1 | Aug 13 | compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal |