Skip to content
OpenAdvisories

Product · DependencyTrack

dependency-track

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 4.7
    CVE-2025-61776

    Dependency-Track possibly discloses private NuGet repository credentials to api.nuget.org

    Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.13.5, Dependency-Track may send credentials meant for a private NuGet repository to `api.nuget.org` via th…

    DependencyTrack dependency-track
  • Medium 4.4
    CVE-2025-27137

    Dependency-Track vulnerable to local file inclusion via custom notification templates

    Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows users with the `SYSTEM_CONFIGURATION` permission to customize notification templates. Templates are e…

    DependencyTrack dependency-track
  • Medium 5.3
    CVE-2024-54002

    Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint

    Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significant…

    DependencyTrack dependency-track
  • Medium 4.4
    CVE-2022-39351

    Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions

    Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to b…

    DependencyTrack dependency-track