GHSA-72HV-8253-57QQ vulnerabilities

Vulnerabilities for packages: logstash, scala, jenkins, ruby3.2-jrjackson, trino, apache-nifi-registry, dependency-track, jenkins-plugin-manager, management-api-for-apache-cassandra-5.0, wavefront-proxy, airflow, apicurio-registry, akhq, opensearch, neo4j, gradle, spark, wildfly, cassandra-reaper...

GHSA-72HV-8253-57QQ vulnerabilities

Vulnerabilities for packages: apicurio-registry, management-api-for-apache-cassandra-5.0, kayenta, spark, cass-config-builder-fips, spark-kubernetes-operator, kafka, apache-pulsar-fips, opensearch, cass-config-builder, pinot, jenkins, nuxeo, nextflow, cassandra, hadoop-client-modules, apache-hop,...

CVE-2025-1686 vulnerabilities

Vulnerabilities for packages: dependency-track...

CVE-2023-22102 vulnerabilities

Vulnerabilities for packages: dependency-track...

GHSA-P75G-CXFJ-7WRX vulnerabilities

Vulnerabilities for packages: dependency-track...

GHSA-M6VM-37G8-GQVH vulnerabilities

Vulnerabilities for packages: dependency-track...

GHSA-P75G-CXFJ-7WRX vulnerabilities

Vulnerabilities for packages: dependency-track...

GHSA-M6VM-37G8-GQVH vulnerabilities

Vulnerabilities for packages: dependency-track...

CVE-2025-1686 vulnerabilities

Vulnerabilities for packages: dependency-track...

CVE-2023-22102 vulnerabilities

Vulnerabilities for packages: dependency-track...

CVE-2025-64758

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission...

CVE-2025-64758

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission...

GHSA-7XVH-C266-CFR5 @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message

Description Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission can configure a "welcome message", which is HTML that is to be rendered on the login page for branding purposes. When rendering the welcome message, Dependency-Track versions before 4.13.6 did not...

@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message

Description Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission can configure a "welcome message", which is HTML that is to be rendered on the login page for branding purposes. When rendering the welcome message, Dependency-Track versions before 4.13.6 did not...

CVE-2025-64758 @dependencytrack/frontend Vulnerable to Persistent Cross-Site-Scripting via Welcome Message

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission...

CVE-2025-64758 @dependencytrack/frontend Vulnerable to Persistent Cross-Site-Scripting via Welcome Message

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission...

EUVD-2025-197853

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission...

CVE-2025-64758

CVE-2025-64758 affects Dependency-Track frontend (SPA). From 4.12.0 up to before 4.13.6, administrators with SYSTEM_CONFIGURATION could configure a login-page welcome message that was not properly sanitized, allowing arbitrary JavaScript to execute in users’ browsers. The issue results in a persi...

CVE-2025-64758 @dependencytrack/frontend Vulnerable to Persistent Cross-Site-Scripting via Welcome Message

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission...

PT-2025-47186

Name of the Vulnerable Software and Affected Versions Dependency-Track versions prior to 4.13.6 Description Dependency-Track, an open source Component Analysis platform, contains a weakness in its frontend application. Specifically, versions before 4.13.6 do not properly sanitize HTML when...