A Maven dependency scanner resolves your project's full dependency tree — direct, transitive, and everything pulled in via parent POMs and imported BOMs — and checks each artifact for known vulnerabilities. DepWarden is a free one: paste a pom.xml and it does the full resolution and scan, no account.
A pom.xml alone rarely tells you what's actually on the classpath. Parent POM inheritance, imported BOMs (like spring-boot-dependencies) and property interpolation all resolve versions indirectly. A medium-sized Java application's real dependency tree routinely runs 400-800 components once transitives resolve — far more than the direct dependencies block shows. DepWarden performs effective-POM resolution: it walks the parent chain, resolves imported BOMs from Maven Central, and interpolates properties, so the scan matches what actually ends up in your build.
Known CVEs across the resolved tree via the OSV Maven advisory feed, enriched with CISA KEV and FIRST EPSS. CPE-only advisories that OSV alone doesn't cover — some CVEs, notably from Apache-family projects, are published to NVD with only a CPE identifier and no Maven coordinate, invisible to purl-based scanners; DepWarden correlates a curated set of these directly. License risk via SPDX categorisation, and end-of-life libraries via the endoflife.date registry. For a JAR upload, DepWarden reads both the bundled pom.properties (exact version) and the embedded pom.xml (declared dependencies), so a thin JAR reports the same findings as scanning its source pom.xml would.
OWASP Dependency-Check is the well-known free Java SCA tool — a solid CLI/Maven-plugin baseline. DepWarden adds exploitability prioritisation (KEV + EPSS, not just CVSS), typosquat detection, and a zero-install browser workflow alongside a Maven plugin and GitHub Action for CI.
Usage: paste a pom.xml at depwarden.in for an instant scan, use the Maven plugin in your build, or connect a repo branch for scheduled scans. Related: software composition analysis, free vulnerability scanner, what Log4Shell taught us.