Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2586▼ 297 respecto a la semana anterior
Críticas / altas1355▲ 100 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 7 respecto a la semana anterior
Sin puntuar (sin CVSS)56▼ 472 respecto a la semana anterior
9 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Aplazada | Media (4.8) | 0.22% | — | Owasp Dependency-trackAI | 17/11/2025 | 17/6/2026 | @dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEM_CONFIGURATION permission can configure a… | |
| Aplazada | Media (4.7) | 0.28% | — | Owasp Dependency-trackAI | 7/10/2025 | 17/6/2026 | Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.13.5, Dependency-Track may send credentials meant for a private NuGet repository to `api.nuget.org` via the HTTP `Authorization` header, and may disclose names and… | |
| Aplazada | Media (4.4) | 0.19% | — | Owasp Dependency-trackAI | 24/2/2025 | 17/6/2026 | Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows users with the `SYSTEM_CONFIGURATION` permission to customize notification templates. Templates are evaluated using the Pebble template engine. Pebble supports… | |
| Aplazada | Media (5.3) | 0.31% | — | Owasp Dependency-trackAI | 4/12/2024 | 17/6/2026 | Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same action with a username… | |
| Modificada | Media (4.4) | 0.21% | — | Owasp Dependency-track | 25/10/2022 | 17/6/2026 | Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit log in clear text.… | |
| Modificada | Media (5.4) | 0.73% | — | Owasp Dependency-track Frontend | 25/10/2022 | 17/6/2026 | @dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Due to the common practice of providing vulnerability details in markdown format, the Dependency-Track… | |
| Modificada | Alta (8.8) | 0.78% | — | Jenkins Owasp Dependency-track | 30/3/2021 | 17/6/2026 | A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins. | |
| Modificada | Media (6.5) | 1.1% | — | Jenkins Owasp Dependency-track | 30/3/2021 | 17/6/2026 | A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins. | |
| Modificada | Media (5.4) | 0.65% | — | Owasp Dependency-track | 29/7/2019 | 17/6/2026 | Dependency-Track before 3.5.1 allows XSS. |