dependency-track
5.2.1Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.
- Maintenance
- Active366 commits in 3 months · bus factor 1
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 9 advisories7 medium, 2 low · Scorecard 7.9/10
- Supported versions
- 2 lines supportednewest 5.2 · oldest 4.14 until Dec 9, 2026 · 9 ended
4.5k stars · 856 forks · 886 open issues · last release 21 days ago · data checked 55 minutes ago
Security advisories
All advisories on GitHubThe 9 most recent advisories published by the maintainers: 7 medium, 2 low. Check the patched version against the one you run.
- mediumGHSA-93r8-3g93-w2gqNov 17, 2025Possible XML External Entity injection via validation of CycloneDX BOMs in XML format
- Affected
- >=4.11.0, <4.13.6
- Patched in
- >=4.13.6
- mediumCVE-2025-61776Oct 7, 2025Possible disclosure of private NuGet repository credentials to api.nuget.org
- Affected
- < 4.13.5
- Patched in
- 4.13.5
- mediumCVE-2025-27137Feb 24, 2025Local file inclusion via custom notification templates
- Affected
- < 4.12.6
- Patched in
- 4.12.6
- mediumCVE-2024-54002Dec 4, 2024Enumeration of managed users via /api/v1/user/login endpoint
- Affected
- < 4.12.2
- Patched in
- 4.12.2
- mediumCVE-2024-38515Jun 24, 2024Possible XML External Entity injection via upload of CycloneDX BOMs in XML format
- Affected
- >= 3.6.0, < 4.11.4
- Patched in
- 4.11.4
- mediumCVE-2022-39351Oct 11, 2022Logging of API keys in clear text when handling API requests using keys with insufficient permissions
- Affected
- < 4.6.0
- Patched in
- 4.6.0
- lowDec 16, 2019Cross-Site Scripting (XSS): Persistent
- Affected
- >=3.0.0 <= 3.6.1
- Patched in
- 3.7.0
- lowDec 16, 2019Cross-Site Scripting (XSS): Persistent
- Affected
- >=3.0.0 <= 3.6.1
- Patched in
- 3.7.0
- mediumJul 17, 2019Cross-Site Scripting (XSS): Persistent
- Affected
- >=3.0.0 <= 3.5.0
- Patched in
- 3.5.1