Medium
CVE-2025-64758
@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software…
Tag: Dependency-Track
All CVEs associated with "Dependency-Track". Page 1/1 • 9 CVEs.
About “Dependency-Track”
A curated feed of “Dependency-Track”-related CVEs appears below. We currently track 9 CVEs for this tag (all time). In the last 365 days, 2 were published. Average CVSS is 5.5 (all time; 4.8 over 365d), and 11% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-522 - Insufficiently Protected Credentials.
In our taxonomy this topic maps to a LOW impact class. Vendor advisories and release notes are key. Verify compatibility matrices, prefer supported long term versions, and stage rollouts with monitoring. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.
Support & lifecycle: dependency-track
This table shows recent release cycles and their projected end-of-life. Data source: endoflife.date.
| Cycle | Release | Latest | EOL | LTS |
|---|---|---|---|---|
| 4.14 | 4.14.2 | - | ||
| 4.13 | 4.13.6 | Expired | ||
| 4.12 | 4.12.7 | Expired | ||
| 4.11 | 4.11.7 | Expired | ||
| 4.10 | 4.10.1 | Expired | ||
| 4.9 | 4.9.1 | Expired | ||
| 4.8 | 4.8.2 | Expired | ||
| 4.7 | 4.7.1 | Expired |
Maintained Soon (≤ 180 days) Expired
Subscribe lifecycle: RSS · RSS (expired) · ICS
Subscribe CVEs: RSS for “Dependency-Track” · RSS (High+Critical only)
CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).
CVSS ≥ 0.0
2025-11-17
2025-10-07
Medium
CVE-2025-61776
Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.13.5, Dependency-Track may send credentials me…
2025-02-24
Medium
CVE-2025-27137
Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows users with the `SYSTEM_CONFIGURATION` per…
2024-12-04
Medium
CVE-2024-54002
Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoin…
2022-10-25
Medium
CVE-2022-39351
Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid A…
Medium
CVE-2022-39350
@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software…
2021-03-30
High
CVE-2021-21633
A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in…
Medium
CVE-2021-21632
A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stor…
2019-07-29
Medium
CVE-2019-1020007
Dependency-Track before 3.5.1 allows XSS.