Issues

• Title: Question: terms for using the hosted API (api.osv.dev) in a commercial product

  google/osv.dev#6264 · Filter by author franklinosuji2-afk opened on Oct 28, 2026

• TuxCare: version queries return nothing for CentOS, CentOS-Stream, OracleLinux and RHEL advisories

  google/osv.dev#6257 · Filter by author Amadeus-22 opened on Oct 27, 2026

• Allow for an case insensitive API search

  enhancement
  google/osv.dev#6233 · Filter by author kfessel opened on Oct 26, 2026
  

• Improve affected git range enumeration

  google/osv.dev#6221 · Filter by author Ly-Joey opened on Oct 23, 2026
  

• Clarify licenses of aggregated data, in particular undisclosed CC-BY-ND-NC licensed data

  google/osv.dev#6218 · Filter by author pombredanne opened on Oct 22, 2026
  1

• PHP2Shell and every other PHP CVE fixed since May 2026 missing from OSV: new php-src tags never reach the CVE5 converter

  google/osv.dev#6216 · Filter by author nemmy-ballistix opened on Oct 22, 2026
  6

• make triage page metrics look at the new metrics location

  google/osv.dev#6211 · Filter by author jess-lowe opened on Oct 22, 2026

• Data quality issue with CVE-2026-111171

  google/osv.dev#6181 · Filter by author p-linnane opened on Oct 18, 2026

• CVE-2026-100607 and CVE-2026-100606 (Flowise): converted records list the 3.1.4 release commit as "fixed", but the CVEs affect 3.1.4 and have no fix

  data quality
  google/osv.dev#6149 · Filter by author munimv2 opened on Oct 12, 2026
  2

  

• zstd-jni CVEs (CVE-2026-87795 and 8 others) have only GIT ranges, so they are missing from Maven/all.zip and Maven queries

  google/osv.dev#6148 · Filter by author jimshowalter opened on Oct 12, 2026
  1

• Git repository aliases produce duplicate, inconsistent ranges

  google/osv.dev#6144 · Filter by author ppkarwasz opened on Oct 8, 2026
  3

  

• Use packageURL/packageName from CVE5 metadata

  enhancement
  google/osv.dev#6137 · Filter by author katzj opened on Oct 7, 2026
  6

• fix CVE enumerated ordering

  google/osv.dev#6107 · Filter by author jess-lowe opened on Oct 1, 2026

• GHSA advisories incorrectly marked as aliases as each other

  google/osv.dev#6067 · Filter by author G-Rath opened on Sep 25, 2026
  4

• Affected range events in vulnerability pages render unbounded with no collapse or truncation

  good first issue
  Bug

  google/osv.dev#6064 · Filter by author ashmod opened on Sep 24, 2026
  4

  

• Incorrect/missing Android 12 patch metadata for ASB-A-308429049

  google/osv.dev#6060 · Filter by author Kafelixon opened on Sep 23, 2026
  1

• CVE-2026-59083 not returned by /v1/query for affected package pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.21

  google/osv.dev#6020 · Filter by author metawave opened on Sep 14, 2026
  4

  

• Data quality issue. CVE-2026-86145 not reported on pcre2, possibly others are missing as well

  google/osv.dev#5989 · Filter by author kikofernandez opened on Sep 8, 2026
  5

• Worker retries oversized vulnerability updates indefinitely after importer drops message data

  google/osv.dev#5984 · Filter by author keeltrace opened on Sep 7, 2026
  2

• Data quality issue with CVE-2024-11477

  data quality
  google/osv.dev#5953 · Filter by author lorepirri opened on Sep 1, 2026
  3

• Records written before #5592 still serve url-encoded PURL separators

  stale
  google/osv.dev#5888 · Filter by author stickerdaniel opened on Aug 22, 2026
  1

• computeAffectedVersions narrows coarse window after SortEvents lexicographic fallback

  google/osv.dev#5824 · Filter by author SashaMIT opened on Aug 11, 2026
  4

• worker to log more information for gitter internal server errors

  google/osv.dev#5809 · Filter by author cuixq opened on Aug 7, 2026
  1

• Issue with openeuler source returning 404

  stale
  google/osv.dev#5808 · Filter by author another-rex opened on Aug 7, 2026
  3

• Debian unstable release not handled correctly

  fix-it 🔨vulnfeeds
  google/osv.dev#5754 · Filter by author n2b12 opened on Jul 30, 2026
  4