diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 99dd11f4728b033aed95b158b09b10c9ad049618_LmdpdGxhYi1jaS55bWw=..9e1e09be3e09a14dd3666eacb6c6879d352be3a7_LmdpdGxhYi1jaS55bWw= 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -7,6 +7,7 @@
   - tests
   - post-test
   - package
+  - scan-dependencies
   - staging_upload
   - release
   - images
@@ -179,6 +180,27 @@
     - node_modules
   retry: 1
 
+Scan dependencies:
+  image: alpine:3.7
+  stage: scan-dependencies
+  allow_failure: true
+  variables:
+    TERM: xterm-256color
+    REPORT_PATH: ./
+  before_script:
+    - apk update && apk add curl jq bash
+  script:
+    - ./scripts/gitlab-depscan.sh pkg/ubuntu-xenial/version-manifest.json
+  only:
+    - tags@gitlab/omnibus-gitlab
+  dependencies:
+    - Ubuntu-16.04
+  artifacts:
+    expire_in: 7 days
+    when: on_failure
+    paths:
+      - dependency_report.txt
+
 .rpi_tag_template: &rpi_tag_build
   stage: raspbian
   script:
diff --git a/scripts/gitlab-depscan.sh b/scripts/gitlab-depscan.sh
new file mode 100755
index 0000000000000000000000000000000000000000..9e1e09be3e09a14dd3666eacb6c6879d352be3a7_c2NyaXB0cy9naXRsYWItZGVwc2Nhbi5zaA==
--- /dev/null
+++ b/scripts/gitlab-depscan.sh
@@ -0,0 +1,71 @@
+#!/bin/bash
+# Scans the dependencies for security vulnerabilities
+# Arguments: A path to version-manifest.json file
+# example: ./gitlab-debscan.sh $HOME/version-manifest.json
+
+set -e
+
+version_file=$1;
+
+if [ "$#" == "0" ]; then
+  echo "You need to pass a path to versions_manifest file";
+  exit 1;
+fi
+
+if [ ! -f $version_file ]; then
+  echo "$version_file does not exist";
+  exit 1;
+fi
+
+software_versions=($(cat $version_file | jq -r ".software|to_entries|map(\"\(.key)/\(.value.locked_version|tostring)\")|.[]" | grep -v 'null' ))
+base_url=https://cve.circl.lu/api/search
+
+counter=0;
+
+vulnerabilities=""
+short_descriptions=""
+REPORT_PATH=${REPORT_PATH-/tmp}
+
+echo "Checking dependencies for known CVEs"
+printf "%-70s %-10s\n\n" Dependency Status
+for dependency in "${software_versions[@]}"
+do
+  response=$(curl -s $base_url/$dependency);
+
+  if [ "$response" = "[]" ]; then
+    printf "%-70s \033[0;32m%-10s\e[0m\n" ${dependency} Secure;
+  else
+    printf "%-70s \033[0;31m%-10s\e[0m\n" ${dependency} Vulnerable;
+    vulnerabilities="$vulnerabilities\n$dependency: "
+    short_descriptions="$short_descriptions\n$dependency: "
+    for row in $(echo "${response}" | jq -r '.[] | @base64'); do
+      _jq(){
+        echo ${row} | base64 -d | jq -r ${1}
+      }
+      vulnerability=$(_jq '.')
+      vulnerabilities="$vulnerabilities
+        $(echo $vulnerability |  jq -r '.id')
+        Severity: $(echo $vulnerability | jq -r '.cvss')
+        Summary: $(echo $vulnerability |  jq -r '.summary')
+        References:
+          $(echo $vulnerability | jq -r '.references[1,2]' | tr '\n' ' ')"
+
+      short_descriptions="$short_descriptions
+        - $(echo $vulnerability | jq -r '.id')"
+      counter=$((counter+1));
+    done
+    vulnerabilities="$vulnerabilities\n"
+  fi
+done
+
+if [ "$counter" -gt "0" ]; then
+  echo -e "\033[0;31m$counter vulnerabilities were found\e[0m";
+  echo -e "\033[0;31m$short_descriptions\e[0m";
+  IFS= && echo -e $vulnerabilities > $REPORT_PATH/dependency_report.txt
+  echo "Full dependency scanning report can be found at $REPORT_PATH/dependency_report.txt"
+  exit 1;
+else
+  echo -e "\033[0;32mNo vulnerabilities were found\e[0m";
+  exit 0;
+fi
+echo $vulnerabilities