ossf/cve-bin-tool

View on GitHub

The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.

Stars: 1.8k
Forks: 647
Open beginner issues: 1
Indexed issues: 158
Avg merge: 1d 7h
Merged PRs (30d): 6

Dominant language: Python
License: GPL-3.0
Last GitHub push: Sep 3, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: good first issue hacktoberfest

Beginner friendly Everything

Open All

158 open issues indexed

bug: GAD range rows with a malformed bound (versionStartExcluding = "0)") match every version Open

Difficulty 4/5 3-5 days Newbie friendliness 62/100

ossf/cve-bin-tool#5909 · 1 comment · Opened Sep 10, 2026
Uncaught `CalledProcessError` from `strings` on macOS: BSD `strings` exits 1 on Java class files (0xCAFEBABE misparsed as Mach-O fat binary), crashing the whole scan Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

ossf/cve-bin-tool#5907 · Opened Sep 8, 2026
fix: cveb.in mirror not updating Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 48/100

ossf/cve-bin-tool#5906 · 1 comment · Opened Sep 8, 2026
bug: Java parser ignores groupId, so an internal artifact named `core` is reported as Drupal core, MobileIron Core and ONLYOFFICE core Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

ossf/cve-bin-tool#5904 · Opened Sep 7, 2026
perf: checker performance idea by removing redundant regex Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

ossf/cve-bin-tool#5902 · Opened Sep 5, 2026
fix: NVD CVE download fails after nvd.nist.gov/rest/public/dashboard/statistics was removed Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 68/100

ossf/cve-bin-tool#5896 · Opened Sep 1, 2026
Typo in CVE Binary Tool Documentation link on Wiki Open

Difficulty 1/5 Under an hour Newbie friendliness 88/100

ossf/cve-bin-tool#5881 · Opened Aug 16, 2026
fix: generated VEX outputs contain invalid CSAF fields and unresolved CycloneDX references Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ossf/cve-bin-tool#5846 · Opened Jul 20, 2026
libraries not fully handled Open

bug

Difficulty 5/5 Over a week Newbie friendliness 35/100

ossf/cve-bin-tool#5840 · 2 comments · Opened Jul 16, 2026
fix: CycloneDX SBOM with externalReferences that are not related to CPEs, generate new Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 72/100

ossf/cve-bin-tool#5827 · Opened Jul 9, 2026
fix: [bug description]AttributeError: can't set attributeAttributeError: can't set attribute" in cve-bin-tool/cve_bin_tool/output_engine /console.py Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 48/100

ossf/cve-bin-tool#5792 · Opened Jun 19, 2026
fix: CVE Downloading stop at 60% Open

awaiting submitter bug

Difficulty 3/5 1-2 days Newbie friendliness 48/100

ossf/cve-bin-tool#5779 · 4 comments · Opened Jun 11, 2026
fix: OSV database update consumes excessive resources and process is terminated; GitLab Advisory sync intermittently fails Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 42/100

ossf/cve-bin-tool#5771 · 5 comments · Opened Jun 6, 2026
fix: generated VEX outputs lose CycloneDX BOM component identity Open

bug

Difficulty 5/5 Over a week Newbie friendliness 35/100

ossf/cve-bin-tool#5723 · 2 comments · Opened Apr 22, 2026
fix: all tests in test_nvd_api.py are skipped Open

bug CI tests

Difficulty 3/5 1-2 days Newbie friendliness 35/100

ossf/cve-bin-tool#5710 · 8 comments · Opened Apr 18, 2026
fix: No CVEs from Redhat source in output Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 64/100

ossf/cve-bin-tool#5707 · Opened Apr 17, 2026
Cve output different result depending on cve-bin-tool version? Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ossf/cve-bin-tool#5694 · 1 comment · Opened Apr 13, 2026
fix: test_json.py is not being run Open

bug CI tests

ossf/cve-bin-tool#5689 · 3 comments · 1 assignee · Opened Apr 12, 2026
discussion: CVE-bin-tool monthly meeting interest check Open

discussion

Difficulty 5/5 Over a week Newbie friendliness 20/100

ossf/cve-bin-tool#5687 · 5 comments · Opened Apr 12, 2026
feat(doc): move to PEP621 after drop of python 3.10 Open

blocked enhancement python

Difficulty 3/5 1-2 days Newbie friendliness 48/100

ossf/cve-bin-tool#5605 · 1 comment · Opened Mar 9, 2026
feat: optimizations for OSV data fetching Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/cve-bin-tool#5569 · Opened Feb 28, 2026
fix: Missing CVEs owing to inconsistency between cve db data model and sql query specifying exact versions Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/cve-bin-tool#5517 · 1 comment · Opened Jan 30, 2026
Offline vex report from spdx input using NVD json mirror? Open

Difficulty 4/5 3-5 days Newbie friendliness 38/100

ossf/cve-bin-tool#5502 · Opened Jan 16, 2026
fix:Duplicated EPSS data in database Open

bug good first issue

Difficulty 3/5 1-2 days Newbie friendliness 62/100

ossf/cve-bin-tool#5490 · 3 comments · Opened Jan 8, 2026
fix: some URLs updated from "intel" to "ossf" are now broken Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 30/100

ossf/cve-bin-tool#5478 · 6 comments · Opened Jan 4, 2026
fix: android libraries not supported Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/cve-bin-tool#5441 · 6 comments · Opened Dec 10, 2025
bug: inconsistent CVE findings when using SBOM generated for the same software as input file Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 30/100

ossf/cve-bin-tool#5419 · 1 comment · Opened Nov 15, 2025
ImportError: sys.meta_path is None, Python is likely shutting down Open

Difficulty 3/5 1-2 days Newbie friendliness 42/100

ossf/cve-bin-tool#5403 · 6 comments · Opened Oct 24, 2025
Dubious product names from GAD source Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/cve-bin-tool#5326 · 2 comments · Opened Sep 8, 2025
fix: [bug description] Unknown version in a SBOM component results in exception being raised Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 55/100

ossf/cve-bin-tool#5302 · 1 comment · Opened Aug 24, 2025
ci: stop scanning test/ directory with dependabot Open

CI

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ossf/cve-bin-tool#5253 · 1 comment · Opened Jul 31, 2025
fix: [bug description] Error while fetching OSV CVE : list index out of range Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 30/100

ossf/cve-bin-tool#5252 · 2 comments · Opened Jul 29, 2025
feat: add support for Go's built-in BuildInfo dependency data Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/cve-bin-tool#5243 · 1 comment · Opened Jul 27, 2025
feat: add support for cargo-auditable data format Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/cve-bin-tool#5232 · 2 comments · Opened Jul 20, 2025
feat: new generic regex-based checker Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/cve-bin-tool#5216 · 2 comments · 1 reaction · Opened Jul 14, 2025
fix: [bug description]cve-bin-tool crash in SBOM generation Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ossf/cve-bin-tool#5196 · 2 comments · Opened Jul 3, 2025
feat: Add EUVD support Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/cve-bin-tool#5189 · 1 comment · 1 reaction · Opened Jul 1, 2025
Switch to using cve 2.0 Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/cve-bin-tool#5172 · 11 comments · Opened Jun 24, 2025
CI cache currently not working Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

ossf/cve-bin-tool#5164 · 12 comments · Opened Jun 20, 2025
Is there somewhere to download the database from a browser? Open

Difficulty 2/5 1-3 hours Newbie friendliness 30/100

ossf/cve-bin-tool#5139 · 11 comments · Opened Jun 11, 2025
fix: add docs + test for initial no-scan work Open

ossf/cve-bin-tool#5136 · 4 comments · 1 assignee · Opened Jun 9, 2025
Fuzzing on cve-bin-tool and potentially trying oss-fuzz-gen Open

security

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/cve-bin-tool#5111 · 3 comments · Opened May 30, 2025
Upcoming 3.4.1. release prep Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/cve-bin-tool#5110 · 7 comments · Opened May 30, 2025
fix: `--exclude` parameter not working in version >= 3.2 Open

bug higher priority

Difficulty 3/5 1-2 days Newbie friendliness 58/100

ossf/cve-bin-tool#5100 · 6 comments · Opened May 21, 2025
feat: use default product/vendor/version for vex triage files Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/cve-bin-tool#5072 · 1 comment · Opened May 6, 2025
fix: scan on windows not identifying jar file Open

bug higher priority

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/cve-bin-tool#5066 · 3 comments · Opened May 5, 2025
ci: something up with spelling Open

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

ossf/cve-bin-tool#5044 · Opened Apr 21, 2025
Workflow issue Markdown linting(#1917) Open

Difficulty 4/5 3-5 days Newbie friendliness 28/100

ossf/cve-bin-tool#5041 · 2 comments · Opened Apr 21, 2025
fix: [cve-bin-tool DatabaseError: file is not a database] Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 35/100

ossf/cve-bin-tool#5018 · 1 comment · 1 reaction · Opened Apr 8, 2025
feat: Support different kind of versions in `cve_range` Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 20/100

ossf/cve-bin-tool#4954 · 3 comments · Opened Mar 18, 2025

ossf/cve-bin-tool

Get new issues in your inbox