Osv-scalibr (Google) - vulnerabilities (CVEs)

3 CVEs, 1 in the last 30 days, 15 known versions, newest CVE from 2026-09-29. Vendor: Google.

CVEs of Osv-scalibr

• CVE-2026-102252 - CVSS 6.9 (medium), 2026-09-29: A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who…
• CVE-2025-13425 - CVSS 1.9 (low), 2025-11-20: A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty…
• CVE-2025-5981 - CVSS 6.5 (medium), 2025-06-18: Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container…