Skip to content
OpenAdvisories

Vendor

DependencyTrack

6 known vulnerabilities.

Products

dependency-track 4 frontend 2
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 4.8
    CVE-2025-64758

    @dependencytrack/frontend Vulnerable to Persistent Cross-Site-Scripting via Welcome Message

    @dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users …

    DependencyTrack frontend @dependencytrack/frontend npm
  • Medium 4.7
    CVE-2025-61776

    Dependency-Track possibly discloses private NuGet repository credentials to api.nuget.org

    Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.13.5, Dependency-Track may send credentials meant for a private NuGet repository to `api.nuget.org` via th…

    DependencyTrack dependency-track
  • Medium 4.4
    CVE-2025-27137

    Dependency-Track vulnerable to local file inclusion via custom notification templates

    Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows users with the `SYSTEM_CONFIGURATION` permission to customize notification templates. Templates are e…

    DependencyTrack dependency-track
  • Medium 5.3
    CVE-2024-54002

    Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint

    Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significant…

    DependencyTrack dependency-track
  • Medium 4.4
    CVE-2022-39351

    Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions

    Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to b…

    DependencyTrack dependency-track
  • Medium 5.4
    CVE-2022-39350

    @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details

    @dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Due to the common practice of providing vulne…

    DependencyTrack frontend @dependencytrack/frontend npm