Known vulnerabilities in dependency-track

Software CPE: cpe:2.3:a:dependencytrack:dependency-track:*:*:*:*:*:*:*:*
Total vulnerabilities: 9
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 7.2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting dependency-track dependency-track is affected by 9 known vulnerabilities: 2 medium, 7 low Critical High Medium Low

Vulnerabilities (9)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU127086 - Improper Restriction of XML External Entity Reference ('XXE')
CWE-611 Low
No
No
4.13.6 23.04.2026 SB20260423133
#VU116902 - Insufficiently Protected Credentials
CVE-2025-61776
CWE-522 Medium
No
No
4.13.5 10.10.2025 SB2025101034
#VU104164 - External Control of File Name or Path
CVE-2025-27137
CWE-73 Low
No
No
4.12.6 25.02.2025 SB2025022508
#VU127085 - Observable discrepancy
CVE-2024-54002
CWE-203 Medium
No
No
4.12.2 04.12.2024 SB2024120476
#VU127084 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2024-38515
CWE-611 Low
No
No
4.11.4 24.06.2024 SB20240624137
#VU127083 - Information Exposure Through Log Files
CVE-2022-39351
CWE-532 Low
No
No
4.6.0 11.10.2022 SB2022101180
#VU25496 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-1020007
CWE-79 Low
No
No
3.5.1 20.02.2020 SB2019072926
SB2020072802
#VU127082 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
3.7.0 16.12.2019 SB2019121637
#VU127081 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
3.7.0 16.12.2019 SB2019121637