Dependency-Track ↗

OWASP · Security / SCA

Track your version:Monitors Dependency-Track and tailors your dashboard to that exact version.

5.0.1 · latest cycle100/100 Healthy

Summary iPlain-English security verdict for Dependency-Track, generated from its current health score, actively-exploited vulnerabilities, and latest supported version.

Dependency-Track currently scores 100/100 — healthy. No tracked vulnerabilities are currently known to be exploited in the wild. The latest supported release is 5.0.1. It's on the latest patch with no significant known issues — keep it current.

Disclosure trend iNew CVEs published for Dependency-Track each year (NVD). A higher bar means more disclosures that year — more scrutiny, not necessarily less safe.

'19

'20

'21

'22

'23

'24

'25

'26

Patch priority — what to act on iThe issues to fix first — actively exploited (CISA KEV) first, then by exploitation probability (EPSS), then severity. Each row's "→ fixed in" is the earliest version that patches it; "see advisory" means no fixed version is published.

No urgent unpatched issues identified. ✓

Get alerted about Dependency-Track

Be emailed the moment Dependency-Track gets a newly exploited vulnerability (CISA KEV) or a release reaches end of life. Free · double opt-in · unsubscribe anytime.

We email only on real events for Dependency-Track — no marketing, no sharing, and we never know what you run. Track your whole stack →

Versions & lifecycle iWhen each release line stops receiving security patches (end-of-life). After EOL there are no more fixes — plan upgrades before these dates.

How long each Dependency-Track release line is supported — and when it sunsets. Select a line for its full report.

Dec9'26 Dependency-Track 4.14EOL 2026-12-09

Mar9'26 Dependency-Track 4.13ended 2026-03-09

Apr7'25 Dependency-Track 4.12ended 2025-04-07

Oct1'24 Dependency-Track 4.11ended 2024-10-01

May7'24 Dependency-Track 4.10ended 2024-05-07

Dec8'23 Dependency-Track 4.9ended 2023-12-08

Oct16'23 Dependency-Track 4.8ended 2023-10-16

Apr18'23 Dependency-Track 4.7ended 2023-04-18

Full Dependency-Track end-of-life dates & support timeline →

5.0 latest 5.0.1 Supported 5.0.1 → 4.14 latest 4.14.2 Supported until 2026-12-094.14.2 → 4.13 latest 4.13.6 End of life ended 2026-03-094.13.6 → 4.12 latest 4.12.7 End of life ended 2025-04-074.12.7 → 4.11 latest 4.11.7 End of life ended 2024-10-014.11.7 → 4.10 latest 4.10.1 End of life ended 2024-05-074.10.1 → 4.9 latest 4.9.1 End of life ended 2023-12-084.9.1 → 4.8 latest 4.8.2 End of life ended 2023-10-164.8.2 → 4.7 latest 4.7.1 End of life ended 2023-04-184.7.1 → See all upcoming end-of-life dates →

Frequently asked

Is Dependency-Track safe and patched?

What should I do about Dependency-Track now?

Upgrade Dependency-Track to the latest supported release (5.0.1) or later and apply available security updates, then confirm against OWASP's official advisory.

When does Dependency-Track reach end-of-life?

The latest supported Dependency-Track release is 5.0.1. After end-of-life a release no longer receives security patches.

Which versions of Dependency-Track are still receiving security updates?

Supported Dependency-Track release lines (latest 5.0.1): 5.0, 4.14. End-of-life releases no longer receive security patches.

Informational only, from public data (NVD · CISA KEV · EPSS · endoflife.date), and can lag or miss vendor-specific fixes. Always confirm against OWASP's official advisory before you patch or upgrade — Dependency-Track official site ↗