Issues

• zstd-jni CVEs (CVE-2026-87795 and 8 others) have only GIT ranges, so they are missing from Maven/all.zip and Maven queries

  google/osv.dev#6148 · Filter by author jimshowalter opened on Oct 12, 2026
  1

• Git repository aliases produce duplicate, inconsistent ranges

  google/osv.dev#6144 · Filter by author ppkarwasz opened on Oct 8, 2026
  2

  

• Use packageURL/packageName from CVE5 metadata

  enhancement
  google/osv.dev#6137 · Filter by author katzj opened on Oct 7, 2026
  6

• New data source: ONYEK, advisories for AI agent and MCP packages

  google/osv.dev#6111 · Filter by author Thezenmonster opened on Oct 1, 2026
  1

• fix CVE enumerated ordering

  google/osv.dev#6107 · Filter by author jess-lowe opened on Oct 1, 2026

• New data source: Red Hat Lightwell

  google/osv.dev#6105 · Filter by author syncrou opened on Sep 30, 2026
  3

• GHSA advisories incorrectly marked as aliases as each other

  google/osv.dev#6067 · Filter by author G-Rath opened on Sep 25, 2026
  4

• Affected range events in vulnerability pages render unbounded with no collapse or truncation

  good first issue
  Bug

  google/osv.dev#6064 · Filter by author ashmod opened on Sep 24, 2026
  4

  

• Incorrect/missing Android 12 patch metadata for ASB-A-308429049

  google/osv.dev#6060 · Filter by author Kafelixon opened on Sep 23, 2026
  1

• OSV.dev query API returns no advisory for a valid non-canonical package name (false negative across NuGet, crates.io, npm, and Packagist)

  google/osv.dev#6039 · Filter by author kanokwut opened on Sep 18, 2026
  2

  

• CVE-2026-59083 not returned by /v1/query for affected package pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.21

  google/osv.dev#6020 · Filter by author metawave opened on Sep 14, 2026
  4

  

• Data quality issue. CVE-2026-86145 not reported on pcre2, possibly others are missing as well

  google/osv.dev#5989 · Filter by author kikofernandez opened on Sep 8, 2026
  5

• Worker retries oversized vulnerability updates indefinitely after importer drops message data

  google/osv.dev#5984 · Filter by author keeltrace opened on Sep 7, 2026
  2

• Data quality issue with CVE-2024-11477

  data quality
  google/osv.dev#5953 · Filter by author lorepirri opened on Sep 1, 2026
  3

• Records written before #5592 still serve url-encoded PURL separators

  google/osv.dev#5888 · Filter by author stickerdaniel opened on Aug 22, 2026

• OSV API exposes syntactically incorrect CVSSv4 scores

  stale
  google/osv.dev#5835 · Filter by author Elkasitu opened on Aug 14, 2026
  1

• computeAffectedVersions narrows coarse window after SortEvents lexicographic fallback

  google/osv.dev#5824 · Filter by author SashaMIT opened on Aug 11, 2026
  4

• Investigate funky repo URLs

  stale
  google/osv.dev#5813 · Filter by author Ly-Joey opened on Aug 7, 2026
  1

• create import findings from failed imports

  stale
  google/osv.dev#5812 · Filter by author jess-lowe opened on Aug 7, 2026
  1

• GCS failing to upload object

  fix-it 🔨stale
  google/osv.dev#5811 · Filter by author jess-lowe opened on Aug 7, 2026
  1

• worker to log more information for gitter internal server errors

  google/osv.dev#5809 · Filter by author cuixq opened on Aug 7, 2026
  1

• Issue with openeuler source returning 404

  google/osv.dev#5808 · Filter by author another-rex opened on Aug 7, 2026
  2

• unexpected EOF error in alpine-osv, debian, download-cves

  stale
  google/osv.dev#5804 · Filter by author jess-lowe opened on Aug 7, 2026
  1

• Duplicate range found for repository in NVD affected ranges

  stale
  google/osv.dev#5803 · Filter by author jess-lowe opened on Aug 7, 2026
  1

• Debian unstable release not handled correctly

  fix-it 🔨stalevulnfeeds
  google/osv.dev#5754 · Filter by author n2b12 opened on Jul 30, 2026
  3