OWASP Dependency-Check collects evidence about each dependency, uses it to infer a Common Platform Enumeration (CPE) identifier, and if one is found, lists the CVE entries linked to it. Because the match is inferred from evidence, results are worth reviewing rather than accepting blindly.
The steps it describes
The project page calls Dependency-Check a Software Composition Analysis tool suite that finds a project's dependencies and checks them for known, publicly disclosed vulnerabilities. Its core engine runs analyzers that inspect dependencies and collect what the tool calls evidence. That evidence is used to identify the CPE for each dependency. If a CPE is identified, the report lists the associated CVE entries.
You can run it from a command line, through Maven and Gradle plugins or an Ant task, and from build tools such as Jenkins, GitHub Actions and Azure DevOps.
Why the matching method matters
A CPE is a naming scheme for products. Getting from a file on disk to the right product name and version is an inference step. Names in package metadata do not always line up with names in vulnerability records, so matches can be wrong in either direction: a library flagged because of a similar name, or a real issue missed because no CPE was found. The project page does not discuss accuracy, so treat this as a general property of the approach and check a sample of findings by hand.
A practical test: pick ten findings from a scan, and for each, confirm the reported library and version exist in your build, and that the CVE really applies to that version.
Data sources
The page lists the NVD data feeds hosted by NIST for automatic updates. For specific technologies it also uses the NPM Audit API, OSS Index, RetireJS and Bundler Audit.
Keeping it current
The page notes the initial data download may take ten minutes or more. After that, running the tool at least once every seven days needs only a small JSON file to stay current. For a CI pipeline, plan how the local data is cached so each job does not repeat the large download.
How to evaluate it next to other tools
Compare on your own repositories, with the same questions each time:
- Does it find the same components as your build reports?
- How many findings need manual triage to confirm?
- Does it tell you which findings are reachable?
- How does it behave offline?
Our dependency scanner trial plan covers the comparison in detail.
Try it yourself
Click through it at your own pace, or open it full screen.
Note how each component is tied to a specific version, which is what makes a match checkable.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning with reachability analysis. The free scan at gold.safeguard.sh/scan lets you compare its results with any other tool you run.
Quick check
How often must Dependency-Check update its data?
The project page says running it at least once every seven days needs only a small JSON download to stay current.
Sources
Last reviewed: 19 October 2026.
