Issues

• apiserver: tag maintenance job fails when a tag is only used in a collection project

  defectp2size/S
  DependencyTrack/dependency-track#7755 · Filter by author migus-rs opened on Oct 23, 2026 · 5.2.1

• Container images still trust emSign ECC Root CA - G3 after eMudhra intermediate CA key compromise

  blockeddefectp2size/S
  DependencyTrack/dependency-track#7742 · Filter by author abdul-050 opened on Oct 22, 2026
  2

• PUT /api/v1/analysis silently ignores empty or null analysisDetails

  defectin triage
  DependencyTrack/dependency-track#7740 · Filter by author frrusi opened on Oct 22, 2026

• OSS Index analyzer drops Go findings when response coordinates normalize the version prefix

  defectintegration/ossindexp2size/S
  DependencyTrack/dependency-track#7739 · Filter by author Suhas2109 opened on Oct 22, 2026 · 5.x
  1

• Query timeout introduced with DT 5.1 prevents some scheduled notifications from being sent

  defectp2
  DependencyTrack/dependency-track#7731 · Filter by author migus-rs opened on Oct 21, 2026 · 5.x

• Suppressing vulnerabilities does not trigger metrics recalculation, leaving stale vulnerability counts

  defectp2size/M
  DependencyTrack/dependency-track#7721 · Filter by author lukasz-zaroda opened on Oct 19, 2026 · 5.x
  3

• Log enhancement to identify problem License

  enhancementp2size/S
  DependencyTrack/dependency-track#7669 · Filter by author ptdropper opened on Oct 13, 2026
  4

• Include KEV status in exported files

  enhancementgood first issuep2size/S
  DependencyTrack/dependency-track#7668 · Filter by author t-castelan opened on Oct 13, 2026 · 5.x
  4

• CycloneDX VEX: an affects BOM-Link is applied to every vulnerable component of the project, including components the VEX does not list

  defectp2size/S
  DependencyTrack/dependency-track#7653 · Filter by author imh0st opened on Oct 12, 2026 · 5.x

• V5´s "Attributed On"-logic and date assignment broken (API & Vulnerability Audit)?

  defectin triage
  DependencyTrack/dependency-track#7650 · Filter by author BoaThor opened on Oct 12, 2026

• No notification for a second KEV vulnerability on the same component

  defectin triage
  DependencyTrack/dependency-track#7649 · Filter by author banshee86vr opened on Oct 12, 2026

• OSV data source: import upstream identifiers (Chainguard CGA records carry their CVE there, not in aliases)

  enhancement
  DependencyTrack/dependency-track#7644 · Filter by author igorhrcek opened on Oct 9, 2026
  1

• OSV advisories scoped to one architecture (arch purl qualifier) are matched against components of any architecture

  defectgood first issuep2size/S
  DependencyTrack/dependency-track#7625 · Filter by author xavier-calland opened on Oct 8, 2026 · 5.x
  2

• Migrate OSS Index vuln analyzer to new (unbatched) Guide endpoints

  enhancementintegration/ossindexp2size/M
  DependencyTrack/dependency-track#7605 · Filter by author rogu-beta opened on Oct 6, 2026 · 5.3
  5

• Proposal: Migrate docs from Material for MkDocs to Zensical

  documentationenhancementhelp wantedp3size/S
  DependencyTrack/dependency-track#7597 · Filter by author schewara opened on Oct 6, 2026
  1

• A VEX entry whose affects[].ref cannot be resolved is skipped silently, and the import reports success

  defectp2
  DependencyTrack/dependency-track#7566 · Filter by author fahedouch opened on Oct 4, 2026 · 5.x
  1

• OWASP RR scores are not derived from the vector on the analysis path

  defectp2size/M
  DependencyTrack/dependency-track#7543 · Filter by author fahedouch opened on Oct 3, 2026 · 5.x
  2

• OSV mirror fails on openEuler advisories with package names longer than 255 characters

  defectintegration/osvp2size/S
  DependencyTrack/dependency-track#7526 · Filter by author AlexWilson-GIS opened on Sep 30, 2026 · 5.x
  2

• Retain original uploaded BOM documents for later retrieval

  enhancement
  DependencyTrack/dependency-track#7516 · Filter by author elias-chevere opened on Sep 29, 2026
  1

• Confusing interaction between analysis state and suppression when importing VEX files

  enhancement
  DependencyTrack/dependency-track#7512 · Filter by author schandwerk opened on Sep 29, 2026 · 5.x
  2

• Support vulnerability matching against project-level CPEs

  enhancement
  DependencyTrack/dependency-track#7503 · Filter by author SchlegNi opened on Sep 29, 2026
  3

• Add AnalysisState that expresses active exploitation has been identified

  enhancement
  DependencyTrack/dependency-track#7497 · Filter by author Gronner opened on Sep 28, 2026

• Allow Custom HTTP headers for Notifiers

  enhancement
  DependencyTrack/dependency-track#7495 · Filter by author Gronner opened on Sep 28, 2026

• KEV status (is_kev) not detected for vulnerabilities matched via non-NVD sources, due to missing VULNERABILITY_ALIAS link

  defectpending more information
  DependencyTrack/dependency-track#7445 · Filter by author ronakdak opened on Sep 24, 2026
  2

• Make severity-scoring precedence (CVSSv4 / CVSSv3 / CVSSv2 / OWASP RR) configurable

  enhancement
  DependencyTrack/dependency-track#7443 · Filter by author krzwiatrzyk-lgd opened on Sep 24, 2026
  1