DependencyTrack / DependencyTrack/dependency-track

Components which are not having any vulnerabilities is showing as vulnerable component with CVE's in Dependency Track 4.12.1

Open
#4,468 3 comments 1 reaction 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Components which are not having any vulnerabilities is showing as vulnerable component with CVE's in Dependency Track 4.12.1.
Example:
Name: @react-leaflet/core
Version : 2.1.0
Purl: pkg:npm/%40react-leaflet/core@2.1.0
![Image](https://github.com/user-attachments/assets/ff0bba19-8cd2-4284-9b25-2985fc2a4c95)

Attached is the list of CVE shown by DT for the above Example component

### Steps to Reproduce

1.Create the component and provide the purl as given above
2.Check for vulnerabilities it shows 10 vulnerabilities
3.checked the component and version in other vulnerability sources but they show no vulnerability ( Synk)

### Expected Behavior

1.Only the current vulnerability showed be shown.
2.Historical vulnerabilities should not be shown.

### Dependency-Track Version

4.12.1

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

12

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.