All issues

Search results

Config-driven vulnerability suppression is silent at default verbosity

Status: Open.

#3001 In google/osv-scanner;

· herdiyana256 opened on Aug 17, 2026

CVSSv4 calculation can produce incorrect table and SARIF severity

Status: Open.

#2998 In google/osv-scanner;

· steadytao opened on Aug 16, 2026

spdx.Satisfies: unbounded recursion causes uncatchable stack overflow on deeply nested license expressions

Status: Open.

#2993 In google/osv-scanner;

· Amey-Thakur opened on Aug 15, 2026

osv-scanner fix erroneously reports blocked vulnerabilities as fixed

Status: Open.

#2988 In google/osv-scanner;

· joshuatqualtrics opened on Aug 13, 2026

SARIF output always reports level=warning, ignoring the vulnerability's severity

Status: Open.

#2981 In google/osv-scanner;

· nvuillam opened on Aug 11, 2026

extractRlibArchive exits the process via log.Fatalf on io.EOF, reporting an internal error as exit code 1 ("vulnerabilities or findings")

Status: Open.

#2976 In google/osv-scanner;

· kobihikri opened on Aug 10, 2026

osv-scanner panics on empty license field (index out of range) when --licenses is enabled

Status: Open.

#2968 In google/osv-scanner;

· sl4x0 opened on Aug 6, 2026

requirements.txt transitive traversal could potentially leak other files on the same image in CI

v3Enhancements that require a breaking change (v3)Enhancements that require a breaking change (v3)

Status: Open.

#2954 In google/osv-scanner;

· another-rex opened on Aug 4, 2026

License scanning unavailable: deps.dev returns gRPC Unavailable

Status: Open.

#2942 In google/osv-scanner;

· dustyghost opened on Jul 25, 2026

getNextFixVersion panics on an advisory with an unparsable fixed version, crashing result output

Status: Open.

#2936 In google/osv-scanner;

· ashvinctrl opened on Jul 22, 2026

Support local Maven cache (~/.m2/repository) for transitive dependency resolution

Status: Open.

#2918 In google/osv-scanner;

· relaxnow opened on Jul 7, 2026

False positive on platform-specific RubyGems versions in CycloneDX SBOM

staleThe issue or PR is stale and pending automated closureThe issue or PR is stale and pending automated closure

Status: Open.

#2898 In google/osv-scanner;

· xballoy opened on Jun 19, 2026