Skip to content
THREATWIRE

OWASP Dependency-Check

Software composition analysis for known vulnerable libraries

OWASP software composition analysis tool that identifies project dependencies and checks them for publicly disclosed vulnerabilities.

Open sourceApache-2.0
Alternative toSnykSonatype Lifecycle
Visit website View repository Docs
Homepage of OWASP Dependency-Check
Official website (owasp.org), captured by ThreatWire.

What OWASP Dependency-Check does

Dependency-Check scans a project's dependencies, identifies them using CPE and package identifiers and reports known vulnerabilities from the NVD and other sources. Its strongest support is for Java and .NET, with analysers for several other ecosystems.

It is available as a command-line tool and as plugins for Maven, Gradle, Ant and Jenkins. The repository moved from a personal account to the dependency-check organisation; the old URL now redirects.

Key features

  • Dependency identification via CPE and package coordinates
  • NVD and other vulnerability data sources
  • Maven, Gradle, Ant and Jenkins integrations
  • Suppression files for false positives
  • HTML, JSON, XML and SARIF reports

Licence

Apache-2.0 · Apache License 2.0 · Open source

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: Apache-2.0.

Security of OWASP Dependency-Check itself

1 published advisory for OWASP Dependency-Check in GitHub repository advisories and OSV.dev. Keep the tool updated: security tools often run with broad access.

Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.

Categories and tags

Dependencies and SBOM (SCA)#sca#owasp#java#maven#gradle#security-audit#build-tool#maven-plugin#jenkins-plugin#gradle-plugin#vulnerability-detection

Related tools

  • Grype

    Vulnerability scanner for images, file systems and SBOMs

    Anchore's vulnerability scanner for container images, file systems and SBOMs, matching packages against a regularly updated vulnerability database.

    Stars
    13k
    Forks
    920
    Last commit
    today
    Apache-2.0Open sourceDependencies and SBOM (SCA)
    Alternative toSnykSonatype Lifecycle

  • OSV-Scanner

    Dependency scanner backed by the OSV database

    Google's vulnerability scanner that reads lockfiles, SBOMs and container images and checks the packages against the open OSV.dev database.

    Stars
    11k
    Forks
    816
    Last commit
    7 days ago
    Apache-2.0Open sourceDependencies and SBOM (SCA)
    Alternative toSnykSonatype Lifecycle

  • Syft

    SBOM generator for images and file systems

    CLI tool and Go library from Anchore that generates a software bill of materials from container images and file systems in SPDX and CycloneDX formats.

    Stars
    9.7k
    Forks
    1k
    Last commit
    today
    Apache-2.0Open sourceDependencies and SBOM (SCA)
    Alternative toSonatype LifecycleSnyk

  • Trivy

    All-in-one scanner for images, code, IaC and clusters

    Scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licences in container images, file systems, repositories and Kubernetes.

    Stars
    39k
    Forks
    776
    Last commit
    today
    Apache-2.0Open sourceContainer and Kubernetes security
    Alternative toSnykPrisma Cloud+1

  • Checkov

    Static analysis for infrastructure as code

    Policy-as-code scanner for Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and more, with graph-based checks across resources.

    Stars
    9.1k
    Forks
    1.4k
    Last commit
    6 days ago
    Apache-2.0Open sourceCloud and IaC security
    Alternative toPrisma CloudWiz+1

Related on ThreatWire

Share on X@threatwire_https://www.threatwire.tech/tools/dependency-check