Skip to main content

Invicti AppSec Core release notes

RSS feed

Track new features, improvements, and fixed issues across Invicti AppSec Core releases. Each entry describes what changed and what you can do as a result.

2026​

This section covers all releases for 2026, updated as new releases ship.

Release 20260902​

Release date: 2 September 2026

New features​

  • AI Bill of Materials (AI-BOM) detection and inventory: Invicti AppSec Core now detects and inventories the AI components your applications include or consume - AI/ML frameworks and agentic libraries. Identified components are available in an AI inventory view and exportable in CycloneDX 1.6 format, in line with the OWASP AIBOM standard and EU AI Act Article 53 requirements.
  • Bulk target import: Import multiple targets at once from the Targets page. Enter URLs manually or upload a CSV file containing target details such as name, URL, description, credentials, and team assignment. Imported targets appear in the Targets list with Not Scanned status and have the Invicti DAST Scanner assigned automatically. A sample CSV file is available to download from the import page.
  • VEX support for SCA scans: SCA scans now produce VEX (Vulnerability Exploitability eXchange) statements alongside results. Use them to tell apart exploitable vulnerabilities from findings that don't apply to your environment, prioritize remediation, and demonstrate compliance to auditors.

Improvements​

  • Severity ordering in Vulnerability Group View: Vulnerability groups sorted by Severity now appear in rank order (Critical, High, Medium, Low) by default. You can also select Severity from the Sort dropdown to control group ordering explicitly.
  • Sorting restored for vulnerability count columns: Vulnerability count columns are sortable again. A tooltip shows the sort direction for the next click.
  • Item counts on Scans screens: Total scan counts now appear in the Scans sidebar and pagination for each tab (All, Queued, Completed, Failed), giving you an at-a-glance count without paging through results.

Resolved issues​

  • Automation Rule "Apply To" settings not saving: Team and Label selections in Automation Rules now save and display correctly after editing. Rule copies also retain the original team scope.
  • Automation rules not firing after scans: Automation rules now trigger correctly when a scan finishes.
  • Large repository scans failing: SAST, SCA, Secrets, and IaC scans on large repositories complete the clone phase successfully.
  • Product pages returning 403 for Viewer role: Viewer-role users can now access Product pages without encountering a 403 error.
  • "Failed to get vulnerabilities" error in grouped view: Selecting a project name in the Scanner + Projects group view now loads its vulnerability table correctly.
  • Scans table layout: The Scans table no longer displays extra whitespace or an inner scrollbar.
  • Edit Collection help links: Help links on the Edit Collection page now point to the correct documentation.
  • Background scan processing reliability: Background scan workers no longer stall unexpectedly, improving overall processing reliability.