There is a paper by Paolo Gasti and Kasper Bonne Rasmussen from the University of California which looks at the storage formats used by various passwords managers - they do highlight some issues with Keepass 2.x format, but these have been fixed since the paper was published.
There was also a tool released, KeeFarce which claimed to be able to extract passwords from memory of running Keepass instances.
However, I can't find any evidence of an independent security analysis being carried out against the code. I can't find any evidence of one against PasswordSafe, which is probably the most direct competitor either.
In this case, though, I suspect that even a password safe with local flaws (e.g. in-memory data being recoverable) is better than repeating passwords across multiple sites, given the most common attack vectors. It is rare for non-nation-state/espionage attackers to go after specific passwords. They tend to go for database dumps with lots of different passwords in, looking for potentially useful data they can use to gain value, in the form of more useful sites, or in goods. Even an unencrypted text file with site-specific passwords in, stored on your local system (please don't do this!) offers good protection against this attack method, compared with memorising one really strong password and using it everywhere. Clearly, this wouldn't apply if the safe was sending password data out to a third party, but this is also easier to check - run the application on a machine connected through a monitoring switch, and see if it sends anything you aren't expecting during use.
I would be all for an independent security analysis of various open-source password safe systems, but this does require specialist knowledge, and to be repeated if there are major changes to any part of the codebase. This is probably out of the budget for any lone open-source developer. Until then, I would rather people use a unique password for each site they log into, and even a flawed local implementation is probably overall more secure.