CVE-2025-11143 vulnerabilities

Vulnerabilities for packages: akhq, cassandra-reaper, strimzi-kafka-operator, cloudwatch-exporter, spark, dependency-track, zookeeper, trino, solr, confluent-kafka, druid, kafka...

GHSA-WJPW-4J6X-6RWH vulnerabilities

Vulnerabilities for packages: akhq, cassandra-reaper, strimzi-kafka-operator, cloudwatch-exporter, spark, dependency-track, zookeeper, trino, solr, confluent-kafka, druid, kafka...

GHSA-WJPW-4J6X-6RWH vulnerabilities

Vulnerabilities for packages: dependency-track-apiserver, cruise-control, cassandra-reaper, kafka-fips, neo4j, celeborn, trino, solr, apache-hop-fips, confluent-kafka, spark, cruise-control-fips, spark-kubernetes-operator, pinot-fips, wso2is, strimzi-kafka-operator, dependency-track, zookeeper,...

CVE-2025-11143 vulnerabilities

Vulnerabilities for packages: dependency-track-apiserver, cruise-control, cassandra-reaper, kafka-fips, neo4j, celeborn, trino, solr, apache-hop-fips, confluent-kafka, spark, cruise-control-fips, spark-kubernetes-operator, pinot-fips, wso2is, strimzi-kafka-operator, dependency-track, zookeeper,...

GHSA-72HV-8253-57QQ vulnerabilities

Vulnerabilities for packages: celeborn, jenkins, tez, apache-nifi, flyway, wavefront-proxy, zipkin, gradle, jenkins-plugin-manager, ruby3.3-jrjackson, druid, ruby4.0-jrjackson, airflow, kafka, neo4j, akhq, apicurio-registry, gradle-stage0, cassandra-reaper, nextflow, opensearch,...

GHSA-72HV-8253-57QQ vulnerabilities

Vulnerabilities for packages: s3proxy, cassandra, jenkins-plugin-manager, conductor-fips, seata, nacos, guacamole-client, elasticsearch-fips, gradle-stage0, management-api-for-apache-cassandra-5.0, kafbat-ui, kafka-bridge-fips, confluent-kafka, spark, pinot-fips, wso2is, ruby3.2-jrjackson,...

CVE-2025-1686 vulnerabilities

Vulnerabilities for packages: dependency-track...

GHSA-P75G-CXFJ-7WRX vulnerabilities

Vulnerabilities for packages: dependency-track...

GHSA-M6VM-37G8-GQVH vulnerabilities

Vulnerabilities for packages: dependency-track...

CVE-2023-22102 vulnerabilities

Vulnerabilities for packages: dependency-track...

CVE-2025-1686 vulnerabilities

Vulnerabilities for packages: dependency-track...

CVE-2023-22102 vulnerabilities

Vulnerabilities for packages: dependency-track...

GHSA-M6VM-37G8-GQVH vulnerabilities

Vulnerabilities for packages: dependency-track...

GHSA-P75G-CXFJ-7WRX vulnerabilities

Vulnerabilities for packages: dependency-track...

CVE-2025-64758

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission...

CVE-2025-64758

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission...

GHSA-7XVH-C266-CFR5 @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message

Description Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission can configure a "welcome message", which is HTML that is to be rendered on the login page for branding purposes. When rendering the welcome message, Dependency-Track versions before 4.13.6 did not...

@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message

Description Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission can configure a "welcome message", which is HTML that is to be rendered on the login page for branding purposes. When rendering the welcome message, Dependency-Track versions before 4.13.6 did not...

CVE-2025-64758

CVE-2025-64758 affects Dependency-Track frontend (SPA). From 4.12.0 up to before 4.13.6, administrators with SYSTEM_CONFIGURATION could configure a login-page welcome message that was not properly sanitized, allowing arbitrary JavaScript to execute in users’ browsers. The issue results in a persi...

CVE-2025-64758 @dependencytrack/frontend Vulnerable to Persistent Cross-Site-Scripting via Welcome Message

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission...