Issues

• OWASP RR scores are not derived from the vector on the analysis path

  defectin triage
  DependencyTrack/dependency-track#7543 · Filter by author fahedouch opened on Oct 3, 2026

• OSV mirror fails on openEuler advisories with package names longer than 255 characters

  defectintegration/osvp2size/S
  DependencyTrack/dependency-track#7526 · Filter by author AlexWilson-GIS opened on Sep 30, 2026 · 5.x
  2

• Retain original uploaded BOM documents for later retrieval

  enhancement
  DependencyTrack/dependency-track#7516 · Filter by author elias-chevere opened on Sep 29, 2026

• Confusing interaction between analysis state and suppression when importing VEX files

  enhancement
  DependencyTrack/dependency-track#7512 · Filter by author schandwerk opened on Sep 29, 2026 · 5.x
  2

• Support vulnerability matching against project-level CPEs

  enhancement
  DependencyTrack/dependency-track#7503 · Filter by author SchlegNi opened on Sep 29, 2026
  2

• Add AnalysisState that expresses active exploitation has been identified

  enhancement
  DependencyTrack/dependency-track#7497 · Filter by author Gronner opened on Sep 28, 2026

• Allow Custom HTTP headers for Notifiers

  enhancement
  DependencyTrack/dependency-track#7495 · Filter by author Gronner opened on Sep 28, 2026

• KEV status (is_kev) not detected for vulnerabilities matched via non-NVD sources, due to missing VULNERABILITY_ALIAS link

  defectpending more information
  DependencyTrack/dependency-track#7445 · Filter by author ronakdak opened on Sep 24, 2026
  1

• NegativeArraySizeException / statement timeout in ReconcileVulnAnalysisResultsActivity on large, weakly-identified component sets

  defectin triage
  DependencyTrack/dependency-track#7444 · Filter by author ronakdak opened on Sep 24, 2026

• Make severity-scoring precedence (CVSSv4 / CVSSv3 / CVSSv2 / OWASP RR) configurable

  enhancement
  DependencyTrack/dependency-track#7443 · Filter by author krzwiatrzyk-lgd opened on Sep 24, 2026
  1

• Adding Tag and EPSS score as filter and also as column in Vulnerability Audit page

  enhancement
  DependencyTrack/dependency-track#7436 · Filter by author itmanju opened on Sep 24, 2026

• [Bug] PostgreSQL PSQLException: ERROR: smallint out of range in WorkflowTaskWorker on dex_workflow_task.lock_version

  defectp2size/S
  DependencyTrack/dependency-track#7434 · Filter by author AsapHogFtw opened on Sep 23, 2026 · 5.x
  7

• Go pseudo-version fix boundary still matches all tagged versions when versionStartIncluding is "0"

  defectp2size/S
  DependencyTrack/dependency-track#7423 · Filter by author fffinkel opened on Sep 22, 2026 · 5.x

• ProjectMetrics.firstOccurrence/lastOccurrence omitted from collection-project lookups despite being required by the OpenAPI spec

  api docsdefectp2size/S
  DependencyTrack/dependency-track#7421 · Filter by author dh-seanmurphy opened on Sep 22, 2026 · 5.x

• BOM import fails silently when a purl contains non-ASCII characters (packageurl-java 1.5.0 corrupts percent-encoding, overflowing PURLCOORDINATES)

  blockeddefectp2size/M
  DependencyTrack/dependency-track#7314 · Filter by author Maik572 opened on Sep 14, 2026
  1

• Include component occurrences in the Finding Packaging Format export

  enhancement
  DependencyTrack/dependency-track#7291 · Filter by author webdevred opened on Sep 11, 2026

• Sync Frontend and APIserver docker variables

  enhancement
  DependencyTrack/dependency-track#7261 · Filter by author iFuzzle opened on Sep 8, 2026

• Paging of Vulnerabilites for a component returns more entries than expected

  defectp2size/S
  DependencyTrack/dependency-track#7210 · Filter by author HDiersenSteute opened on Sep 2, 2026 · 5.1.2

• Disabling a project version retroactively updates graph

  defectin triage
  DependencyTrack/dependency-track#7209 · Filter by author Xenira opened on Sep 2, 2026
  1

• Adding EPSS score columns to Vulnerability Audit view

  enhancementp2size/S
  DependencyTrack/dependency-track#7197 · Filter by author itmanju opened on Sep 1, 2026 · 5.x

• NVD mirror ignores CVSS metric type and picks CNA/ADP rating over NIST Primary rating

  defectin triage
  DependencyTrack/dependency-track#7192 · Filter by author FlyingCoconut948 opened on Aug 31, 2026
  2

• Project-level vulnerability deduplication

  enhancement
  DependencyTrack/dependency-track#7161 · Filter by author Nihlus opened on Aug 28, 2026

• NVD mirror fails with: Unexpected response code: 404

  defectintegration/nvdpending more information
  DependencyTrack/dependency-track#7155 · Filter by author olazkano opened on Aug 28, 2026
  3

• Support for oauth2-proxy

  enhancementhelp wantedp3size/M
  DependencyTrack/dependency-track#7141 · Filter by author phmcder opened on Aug 27, 2026
  1

• Customizable placeholder texts for the create vulnerability and audit forms

  enhancement
  DependencyTrack/dependency-track#7116 · Filter by author heyiamwahab236 opened on Aug 25, 2026