Vulnerabilities

TI-2025-40096 CVE-2025-64758 · GHSA-7xvh-c266-cfr5

@dependencytrack/frontend Vulnerable to Persistent Cross-Site-Scripting via Welcome Message

LOW 22

@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00239 Published 2025-11-17 Fixed in 4.13.6 CWE-79

TI-2025-38169 CVE-2025-61776

Dependency-Track possibly discloses private NuGet repository credentials to api.nuget.org

LOW 21

Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00276 Published 2025-10-07 Fixed in 4.13.5 CWE-522

TI-2025-19994 CVE-2025-27137

Dependency-Track vulnerable to local file inclusion via custom notification templates

MEDIUM 54

Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain.

CVSS 3.1MEDIUM 4.4 Local High privileges No interaction EPSS 0.00186 Published 2025-02-24 Fixed in 4.12.6 CWE-73

TI-2024-36157 CVE-2024-54002

Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint

LOW 30

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00309 Published 2024-12-04 Fixed in 4.12.2 CWE-203

Vulnerabilities

Filters

@dependencytrack/frontend Vulnerable to Persistent Cross-Site-Scripting via Welcome Message

Dependency-Track possibly discloses private NuGet repository credentials to api.nuget.org

Dependency-Track vulnerable to local file inclusion via custom notification templates

Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint