Dependency Vulnerabilities
High · Supply Chain
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-1104
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-1104
Definition
Known CVEs in third-party libraries.
Root cause
Unpatched dependencies.
Affected components
- Components in the “Supply Chain” class
- Application / API handlers
- Supporting libraries
Impact
RCE, data breach via library flaws.
Severity
High · CVSS 7.5
Safe lab reproduction
lab-sbom
Detection methodology
SCA in CI; SBOM monitoring.
Evidence examples
- Lab reproduction notes: lab-sbom
- Request/response excerpts (redacted)
- Detection signal: SCA in CI; SBOM monitoring
Remediation
Patch/update; pin versions; monitor advisories.
Secure coding examples
Automate Dependabot/Renovate + SCA gates.
Related CYNARKS lessons & labs
Practise related skills in Labs or deepen on Academy library.