CVE-2025-11143 vulnerabilities

Vulnerabilities for packages: dependency-track, akhq, solr, confluent-kafka, strimzi-kafka-operator, druid, apache-tika, zookeeper, kafka, trino, spark, cassandra-reaper, cloudwatch-exporter...

GHSA-WJPW-4J6X-6RWH vulnerabilities

Vulnerabilities for packages: dependency-track, akhq, solr, confluent-kafka, strimzi-kafka-operator, druid, apache-tika, zookeeper, kafka, trino, spark, cassandra-reaper, cloudwatch-exporter...

CVE-2025-11143 vulnerabilities

Vulnerabilities for packages: dependency-track, wso2is, cloudwatch-exporter, solr, pinot-fips, druid, neo4j, akhq, apache-hop-fips, zookeeper-fips, spark-fips, celeborn, pinot, confluent-kafka-jre-bcfips, confluent-kafka, trino, zookeeper, apache-tika-fips, cruise-control, cassandra-reaper, kafka...

GHSA-WJPW-4J6X-6RWH vulnerabilities

Vulnerabilities for packages: dependency-track, wso2is, cloudwatch-exporter, solr, pinot-fips, druid, neo4j, akhq, apache-hop-fips, zookeeper-fips, spark-fips, celeborn, pinot, confluent-kafka-jre-bcfips, confluent-kafka, trino, zookeeper, apache-tika-fips, cruise-control, cassandra-reaper, kafka...

GHSA-72HV-8253-57QQ vulnerabilities

Vulnerabilities for packages: apicurio-registry, tez, apache-tika, airflow, scala, trino, spark, jenkins, ruby3.2-jrjackson, jenkins-plugin-manager, dependency-track, flyway, neo4j, apache-nifi, solr, infinispan, druid, strimzi-kafka-operator, spdx-tools-java, akhq, wildfly, ruby4.0-jrjackson,...

GHSA-72HV-8253-57QQ vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.0, nacos-docker, hadoop-client-modules, kayenta, apache-hop-fips, apache-nifi, tritonserver-backend-vllm-cuda-12.9, pinot, logstash-fips, zipkin, camunda-zeebe, knative-kafka-broker, conductor, gradle-stage0, kafka, localstack,...

CVE-2025-1686 vulnerabilities

Vulnerabilities for packages: dependency-track...

GHSA-P75G-CXFJ-7WRX vulnerabilities

Vulnerabilities for packages: dependency-track...

CVE-2023-22102 vulnerabilities

Vulnerabilities for packages: dependency-track...

GHSA-M6VM-37G8-GQVH vulnerabilities

Vulnerabilities for packages: dependency-track...

CVE-2025-1686 vulnerabilities

Vulnerabilities for packages: dependency-track...

CVE-2023-22102 vulnerabilities

Vulnerabilities for packages: dependency-track...

GHSA-M6VM-37G8-GQVH vulnerabilities

Vulnerabilities for packages: dependency-track...

GHSA-P75G-CXFJ-7WRX vulnerabilities

Vulnerabilities for packages: dependency-track...

CVE-2025-64758

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission...

CVE-2025-64758

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission...

@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message

Description Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission can configure a "welcome message", which is HTML that is to be rendered on the login page for branding purposes. When rendering the welcome message, Dependency-Track versions before 4.13.6 did not...

GHSA-7XVH-C266-CFR5 @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message

Description Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission can configure a "welcome message", which is HTML that is to be rendered on the login page for branding purposes. When rendering the welcome message, Dependency-Track versions before 4.13.6 did not...

CVE-2025-64758

CVE-2025-64758 affects Dependency-Track frontend (SPA). From 4.12.0 up to before 4.13.6, administrators with SYSTEM_CONFIGURATION could configure a login-page welcome message that was not properly sanitized, allowing arbitrary JavaScript to execute in users’ browsers. The issue results in a persi...

CVE-2025-64758 @dependencytrack/frontend Vulnerable to Persistent Cross-Site-Scripting via Welcome Message

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission...