Software Supply Chain Failures
New in 2025 as an expansion of 2021's vulnerable-and-outdated-components category. Covers dependencies plus the systems that build, store, and ship software: CI, registries, and update channels. OWASP says it has few occurrences in the contributed data (5…
OWASP rank: 3
Practical checks
- Fingerprint frameworks and lockfiles you can see, then match names to advisories rather than guessing versions
- Treat CI workflows, artifact registries, and update channels as in-scope only when the program says so
- Look for dependency-confusion and unsigned update assumptions as design questions, not as a scanner spray
- Separate a known vulnerable library from proof that the vulnerable function is reachable
- Prefer vendor advisories and NVD over random PoC repositories