Dependencytrack vulnerabilities

Products

• Frontend 13
• Dependency-track 5

Newest

• dependencytrack frontend @dependencytrack/frontend Vulnerable to Persistent Cross-Site-Scripting via Welcome Message CVE-2025-64758 Fix available 4.8 MediumNovember 17, 2025
• dependencytrack dependency-track Dependency-Track possibly discloses private NuGet repository credentials to api.nuget.org CVE-2025-61776 4.7 MediumOctober 7, 2025
• dependencytrack dependency-track Dependency-Track vulnerable to local file inclusion via custom notification templates CVE-2025-27137 4.4 MediumFebruary 24, 2025
• dependencytrack dependency-track Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint CVE-2024-54002 5.3 MediumDecember 4, 2024
• dependencytrack frontend X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance mode CVE-2022-43515 Fix available 5.3 MediumDecember 5, 2022
• dependencytrack dependency-track Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions CVE-2022-39351 4.4 MediumOctober 25, 2022
• dependencytrack frontend, owasp dependency-track frontend +1 more @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details CVE-2022-39350 Fix available 5.4 MediumOctober 25, 2022
• dependencytrack frontend, zabbix, fedoraproject fedora +2 more Reflected XSS in the backurl parameter of Zabbix Frontend CVE-2022-40626 Fix available 4.8 MediumSeptember 14, 2022
• dependencytrack frontend, zabbix +1 more Reflected XSS in graphs page of Zabbix Frontend CVE-2022-35230 Fix available 3.7 LowJuly 6, 2022
• dependencytrack frontend, zabbix +1 more Reflected XSS in discovery page of Zabbix Frontend CVE-2022-35229 Fix available 3.7 LowJuly 6, 2022
• dependencytrack frontend, debian linux, fedoraproject fedora +2 more Reflected XSS in graph configuration window of Zabbix Frontend CVE-2022-24919 Fix available 3.7 LowMarch 9, 2022
• dependencytrack frontend, fedoraproject fedora +1 more Reflected XSS in item configuration window of Zabbix Frontend CVE-2022-24918 Fix available 3.7 LowMarch 9, 2022
• dependencytrack frontend, debian linux, fedoraproject fedora +2 more Reflected XSS in service configuration window of Zabbix Frontend CVE-2022-24917 Fix available 3.7 LowMarch 9, 2022
• dependencytrack frontend, debian linux, fedoraproject fedora +2 more Reflected XSS in action configuration window of Zabbix Frontend CVE-2022-24349 Fix available 4.6 MediumMarch 9, 2022
• dependencytrack frontend, zabbix, debian linux +1 more +3 more Possible view of the setup pages by unauthenticated users if config file already exists CVE-2022-23134 In KEVPublic exploitFix available EPSS 93.9% 3.7 LowJanuary 13, 2022
• dependencytrack frontend, zabbix, fedoraproject fedora +2 more Stored XSS in host groups configuration window in Zabbix Frontend CVE-2022-23133 Fix available 6.3 MediumJanuary 13, 2022
• dependencytrack frontend, zabbix +1 more Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML CVE-2022-23131 In KEVPublic exploit EPSS 95.7% 9.1 CriticalJanuary 13, 2022
• dependency-track Dependency-Track before 3.5.1 allows XSS. CVE-2019-1020007 5.4 MediumJuly 29, 2019