Skip to main content

Invicti Platform Security checks and Runtime SCA findings

RSS feed

Track new security checks, vulnerability detection capabilities, and Runtime SCA findings introduced in each Invicti Platform on-demand release. Updates include enhanced detection methods, CVE coverage, and improvements to vulnerability identification.

2026​

Security checks, vulnerability database updates, and Runtime SCA enhancements released in 2026.

Release 20260928​

Release date: 28 September 2026

Security checks​

Release 20260922​

Release date: 22 September 2026

Improvements​

  • Leaked secret detection: Detection of leaked secrets is improved with better coverage and adding GitHub tokens detection.

Release 20260914​

Release date: 14 September 2026

Security checks​

Release 20260909​

Release date: 9 September 2026

Security checks​

Improvements​

  • Nginx alias path traversal detection: Detection accuracy for Nginx alias path traversal vulnerabilities is improved.
  • HTTP verb tampering detection: Detection coverage for authentication bypass via HTTP verb tampering is expanded.

Release 20260831​

Release date: 31 August 2026

Security checks​

  • Added security check for insecure use of iframes.

Improvements​

  • fancyBox library version detection: Invicti now detects the fancyBox jQuery plugin and its version, enabling better coverage of known vulnerabilities in this library.
  • Apache HTTP Server path traversal detection: Detection accuracy for CVE-2021-41773 and CVE-2021-42013 is improved.
  • Admin interface detection: Detection coverage for exposed admin interfaces is improved.

Release 20260826​

Release date: 26 August 2026

Security checks​

Release 20260817​

Release date: 17 August 2026

Security checks​

Release 20260812​

Release date: 12 August 2026

Improvements​

  • XSS in JSON security check: The XSS in JSON security check is now a separate, independently configurable script that you can enable or disable on its own.

Resolved issues​

  • Web Cache Deception CWE mapping: Web Cache Deception findings now include the correct CWE mapping.

Release 20260810​

Release date: 10 August 2026

Security checks​

Release 20260723​

Release date: 23 July 2026

Security checks​

Improvements​

  • Added crawling, discovery, and web application firewall (WAF) detection scripts to the default scan profiles

Release 20260714​

Release date: 14 July 2026

Security checks​

Improvements​

  • Reduced false positives for the Client-Side Template Injection (CSTI) security check
  • Reduced false positives for the Weak Session ID check

Release 20260630​

Release date: 30 June 2026

Security checks​

Improvements​

  • Updated CWE classifications for 23 vulnerability types, replacing discouraged CWE identifiers with currently recommended alternatives

Release 20260622​

Release date: 22 June 2026

New features​

  • Added an API Full Scan profile for scanning API targets. The profile applies a comprehensive set of security checks tailored to API structures.

Release 20260618​

Release date: 18 June 2026

Security checks​

Improvements​

  • Reduced false positives for Cross-Site Scripting (XSS)
  • Reduced false positives for the Apache Struts2 Remote Code Execution check (S2-053)
  • Updated the Polyfill.io Supply Chain Compromise check to include the CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) classification

Release 20260608​

Release date: 8 June 2026

Security checks​

  • Added a new security check for JavaScript source map exposure

Improvements​

  • Reduced false positives for time-based SQL injection. Invicti now verifies response delays with a proportionality check before confirming the vulnerability

Release 20260601​

Release date: 1 June 2026

Security checks​

Release 20260525​

Release date: 25 May 2026

Security checks​

Release 20260515 - HF​

Release date: 15 May 2026

Security checks​

Release 20260428​

Release date: 4 May 2026

Security checks​

  • Updated the vulnerability database (VDB) to version 20260428
  • Updated severity ratings for CubeCart versions 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.5.0, 6.5.1, 6.5.2, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10 from High to Critical
  • Updated severity ratings for Dolibarr versions 19.0.2, 19.0.3, 19.0.4, 20.0.0, 20.0.1, 20.0.2 from Medium to High
  • Updated severity ratings for Grafana versions 12.2.3, 12.3.1 from Medium to High
  • Updated severity ratings for Jetty versions 9.4.54, 10.0.25, 11.0.25 from Medium to High
  • Updated severity ratings for OpenSSL versions 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.5.0, 3.5.1, 3.5.2, 3.5.3, 3.5.4, 3.6.0 from High to Critical
  • Updated severity rating for Pega version 25.1.0 from Low to Medium
  • Updated severity ratings for Perl versions 5.9.4, 5.9.5, 5.12.4, 5.12.5, 5.14.4, 5.15.0, 5.15.1, 5.15.2, 5.15.3, 5.15.4, 5.15.5, 5.15.6, 5.15.7, 5.15.8, 5.15.9, 5.16.3, 5.17.0, 5.17.1, 5.17.2, 5.17.3, 5.17.4, 5.17.5, 5.17.6, 5.17.7.0, 5.17.8, 5.17.9, 5.17.10, 5.17.11, 5.18.0, 5.18.1, 5.18.2, 5.18.3, 5.19.0, 5.19.1, 5.19.2, 5.19.3, 5.19.4, 5.19.5, 5.19.6, 5.19.7, 5.19.8, 5.19.9, 5.19.10, 5.19.11, 5.26.3, 5.27.0, 5.27.1, 5.27.2, 5.27.3, 5.27.4, 5.27.5, 5.27.6, 5.27.7, 5.27.8, 5.27.9, 5.27.10, 5.27.11, 5.28.1, 5.28.2, 5.28.3, 5.29.0, 5.29.1, 5.29.2, 5.29.3, 5.29.4, 5.29.5, 5.29.6, 5.29.7, 5.29.8, 5.29.9, 5.29.10, 5.34.2, 5.34.3, 5.36.2, 5.36.3, 5.38.1, 5.38.2, 5.38.3, 5.39.0, 5.39.1, 5.39.2, 5.39.3, 5.39.4, 5.39.5, 5.39.6, 5.39.7, 5.39.8, 5.39.9, 5.39.10, 5.40.0, 5.40.1, 5.41.0, 5.41.1, 5.41.2, 5.41.3, 5.41.4, 5.41.5, 5.41.6, 5.41.7, 5.41.8, 5.41.9, 5.41.10 from High to Critical
  • Added vulnerability detection for axios:
  • Added vulnerability detection for Chamilo:
  • Added vulnerability detection for CubeCart:
  • Added vulnerability detection for Dolibarr:
  • Added vulnerability detection for EspoCRM:
  • Added vulnerability detection for Grafana:
  • Added vulnerability detection for Java:
  • Added vulnerability detection for Jetty:
  • Added vulnerability detection for OpenSSL:
  • Added vulnerability detection for Pega:
  • Added vulnerability detection for Perl:
  • Added vulnerability detection for qdPM:
  • Added vulnerability detection for Serendipity:
  • Added vulnerability detection for XWiki Platform:

Release 20260421​

Release date: 21 April 2026

Security checks​

Release 20260331​

Release date: 31 March 2026

Security checks​

Improvement​

  • Added optional variable for OOB server settings

Release 20260324​

Release date: 24 March 2026

Security checks​

  • Updated the vulnerability database (VDB) to version 20260324
  • Added a new security check of Chrome Logger information disclosure
  • Updated severity ratings for Craft CMS versions 4.17.0, 4.17.1, 4.17.2, 4.17.3, 5.9.0, 5.9.1, 5.9.2, 5.9.3, 5.9.4, 5.9.5, 5.9.6 from Medium to Critical
  • Updated severity ratings for LimeSurvey versions 1.72, 1.85, 1.86, 3.19.0, 3.19.1, 3.19.2, 3.19.3, 3.20.0, 3.20.2, 3.21.0, 3.21.1, 3.21.2, 3.21.3, 3.21.4, 3.21.5, 3.21.6, 3.22.0, 3.22.1, 3.22.2, 3.22.3, 3.22.4, 3.22.5, 3.22.6, 3.22.7, 3.22.8, 3.22.9, 3.22.10, 3.22.11, 3.22.12, 3.22.13, 3.22.14, 3.22.15, 3.22.16, 3.22.17, 3.22.18, 3.22.19, 3.22.20, 3.22.21, 3.22.210, 3.22.24, 3.22.25, 3.22.26, 3.22.27, 3.22.28, 3.22.29, 3.23.0, 3.23.1, 3.23.2, 3.23.3, 3.23.4, 3.23.5, 3.23.6, 3.23.7, 3.23.22, 3.23.32, 3.24.0, 3.24.1, 3.24.2, 3.24.3, 3.24.4, 3.24.5, 3.24.6, 3.25.0, 3.25.1, 3.25.2, 3.25.3, 3.25.4, 3.25.5, 3.25.6, 3.25.7, 3.25.8, 3.25.9, 3.25.10, 3.25.11, 3.25.12, 3.25.13, 3.25.14, 3.25.15, 3.25.16, 3.25.17, 3.25.18, 3.25.19, 3.25.20, 3.25.21, 3.25.22, 3.26.0, 3.26.1, 3.26.2, 3.26.3, 3.26.4, 3.26.5, 3.27.0, 3.27.1, 3.27.2, 3.27.3, 3.27.4, 3.27.5, 3.27.6, 3.27.7, 3.27.8, 3.27.9, 3.27.10, 3.27.11, 3.27.12, 3.27.13, 3.27.14, 3.27.16, 3.27.17, 3.27.18, 3.27.19, 3.27.20, 3.27.21, 3.27.22, 3.27.23, 3.27.24, 3.27.25, 3.27.26, 3.27.27, 3.27.28, 3.27.29, 3.27.30, 3.27.31, 3.27.32, 3.27.33, 3.27.34, 4.0.0, 4.0.1, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6, 4.1.7, 4.1.8, 4.1.9, 4.1.10, 4.1.11, 4.1.12, 4.1.13, 4.1.14, 4.1.15, 4.1.16, 4.1.17, 4.1.18, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.2.6, 4.2.7, 4.2.8, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.3.12, 4.3.13, 4.3.14, 4.3.15, 4.3.16, 4.3.17, 4.3.18, 4.3.19, 4.3.20, 4.3.21, 4.3.22, 4.3.23, 4.3.24, 4.3.25, 4.3.26, 4.3.27, 4.3.28, 4.3.29, 4.3.30, 4.3.31, 4.3.32, 4.3.33, 4.3.34, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 4.4.10, 4.4.11, 4.4.12, 4.4.13, 4.4.14, 4.4.15, 4.4.16, 4.5.0, 4.5.1, 4.5.2, 4.6.0, 4.6.1, 4.6.2, 4.6.3, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.1.7, 5.1.8, 5.1.9, 5.1.10, 5.1.11, 5.1.12, 5.1.13, 5.1.14, 5.1.15, 5.1.16, 5.1.17, 5.1.18, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.2.11, 5.2.12, 5.4.4, 6.2.9 from High to Critical
  • Updated severity ratings for OpenSSL versions 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.5.0, 3.5.1, 3.5.2, 3.5.3, 3.5.4, 3.6.0 from Critical to High
  • Added vulnerability detection for CKEditor:
  • Added vulnerability detection for Chamilo:
  • Added vulnerability detection for Craft CMS:
  • Added vulnerability detection for Jenkins:
  • Added vulnerability detection for LimeSurvey:
  • Added vulnerability detection for MediaWiki:
  • Added vulnerability detection for NextJsReactFramework:
  • Added vulnerability detection for TornadoWebServer:

Improvements​

  • Better detection of Backup folders and files
  • Better detection of Shiro deserialization RCE
  • Fixed Prompt Injection testing in some edge cases

Release 20260310​

Release date: 11 March 2026
Version: 25.12.12

Security checks​

  • Updated the vulnerability database (VDB) to version 20260310
  • Improved technology detection
  • Updated severity ratings for Chamilo versions 1.10.0, 1.10.2, 1.10.4, 1.10.6, 1.10.8, 1.11.26, 1.8.6.1, 1.8.8.3, 1.9.0, 1.9.10, 1.9.10.2, 1.9.10.4, 1.9.6, 1.9.6.1, 1.9.8, 1.9.8.1, 1.9.8.2 from High to Critical
  • Updated severity rating for Chamilo version 1.11.24 from Medium to Critical
  • Updated severity ratings for Craft CMS versions 4.15.6.2, 4.16.17, 4.16.18, 4.16.19, 4.4.14, 4.5.6.1, 5.6.16, 5.7.1.1, 5.8.21, 5.8.22, 5.8.23 from High to Critical
  • Updated severity ratings for DotCMS versions 22.03, 22.03.2, 22.03.4, 22.03.5, 22.03.6, 22.03.7, 22.03.8, 22.03.9, 22.03.10, 22.03.11, 22.03.12, 22.03.13, 22.03.14, 22.03.15, 23.01.1, 23.01.2, 23.01.3, 23.01.4, 23.01.5, 23.01.6, 23.01.7, 23.01.8, 23.01.9, 23.01.10, 23.01.11, 23.01.12, 23.01.13, 23.01.14, 23.01.15, 23.01.16, 23.01.17, 23.10.24.0 from Medium to Critical
  • Updated severity ratings for EspoCRM versions 2.6.0, 2.7.0, 2.7.1, 2.7.2, 2.8.0, 2.8.1, 2.9.0, 2.9.1, 2.9.2, 3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.2.0, 3.2.1, 3.2.2, 3.3.0, 3.4.0, 3.4.1, 3.4.2, 3.5.0, 3.5.1, 3.5.2, 3.6.0, 3.6.1, 3.6.2, 3.7.0, 3.7.1, 3.7.2, 3.7.3, 3.7.4, 3.8.0, 3.9.0, 3.9.1, 3.9.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.2.6, 4.2.7, 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.5.0, 4.5.1, 4.6.0, 4.7.0, 4.7.1, 4.7.2, 4.8.0, 4.8.1, 4.8.2, 4.8.3, 4.8.4, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.1.0, 5.1.1, 5.1.2, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6, 5.4.0, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.6.0, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.10, 5.6.11, 5.6.12, 5.6.13, 5.6.14, 5.7.0, 5.7.1, 5.7.2, 5.7.3, 5.7.4, 5.7.5, 5.7.6, 5.7.7, 5.7.8, 5.7.9, 5.7.10, 5.7.11, 5.8.0, 5.8.1, 5.8.2, 5.8.3, 5.8.4, 5.8.5 from High to Critical
  • Updated severity ratings for osCommerce versions 1.0.6.0, 1.0.7.0, 1.0.7.1, 1.0.7.2, 1.0.7.3, 1.0.7.4, 1.0.7.5, 1.0.7.6, 1.0.7.7, 1.0.7.8, 1.0.7.9, 1.1, 1.11, 1.12, 1.13, 2.3, 2.3.1, 2.3.2, 2.3.3, 2.3.3.1, 2.3.3.2, 2.3.3.3, 2.3.3.4, 2.3.4 from Medium to High
  • Added vulnerability detection for Chamilo:
  • Added vulnerability detection for Craft CMS:
  • Added vulnerability detection for DOMPurify:
  • Added vulnerability detection for Django:
  • Added vulnerability detection for DotCMS:
  • Added vulnerability detection for EspoCRM:
  • Added vulnerability detection for Jetty:
  • Added vulnerability detection for MediaWiki:
  • Added vulnerability detection for Moodle:
  • Added vulnerability detection for Underscore.js:
  • Added vulnerability detection for Werkzeug:
  • Added vulnerability detection for XWikiplatform:
  • Added vulnerability detection for osCommerce:
  • Added vulnerability detection for phpMyFAQ:

Release 20260303​

Release date: 5 March 2026
Version: 25.12.11

Security checks​

Release 20260224​

Release date: 25 February 2026
Version: 25.12.10

Security checks​

Release 20260202​

Release date: 3 February 2026
Version: 25.12.9

Security checks​

  • Updated the vulnerability database (VDB) to version 20260202
  • Added comprehensive JWT authentication bypass detection
    • High: JWT Signature Bypass via None Algorithm
    • High: JWT Signature is not Verified
    • High: JWT Signature Bypass via kid SQL injection
    • High: JWT Signature Bypass via kid Path Traversal
    • High: JWT Signature Bypass via unvalidated jwk parameter
    • High: Unvalidated JWT jku parameter
    • High: Unvalidated JWT x5u parameter
    • High: JWT Signature Bypass via unvalidated jku parameter
    • High: JWT Signature Bypass via unvalidated x5u parameter
    • High: JWT Signature Bypass via unvalidated x5c parameter
  • Added authorization vulnerability detection
    • High: Horizontal Broken Function Level Authorization (BFLA)
    • High: Unauthenticated Access to Sensitive Functions
    • High: Horizontal IDOR/BOLA (Broken Object Level Authorization)
    • High: Vertical Broken Function Level Authorization (BFLA)
    • High: Vertical IDOR/BOLA (Broken Object Level Authorization)
  • Added sensitive information exposure detection
    • High: API Sensitive Info(PII) accessible without authentication
    • Medium: Resource Accessible Without Required Authentication
  • Added API inventory management checks
    • Medium: API Authentication Bypass Using a Test/Staging Host Header
  • Added microservice security checks
    • High: Microservice Directory Traversal
  • Added vulnerability detection for Java:
  • Added vulnerability detection for Jetty:
  • Added vulnerability detection for Joomla:
  • Removed vulnerability detection for LiferayPortal:
  • Added vulnerability detection for LimeSurvey:
  • Added vulnerability detection for MySQL:
  • Added vulnerability detection for Oracle:
  • Added vulnerability detection for Oracle HTTP Server:
  • Added vulnerability detection for osTicket:
  • Added vulnerability detection for phpMyFAQ:
  • Updated severity for Oracle 23.8 from Medium to High
  • Updated severity for osTicket 1.17, 1.17.1, 1.17.3, 1.17.4, 1.17.5, 1.17.6, 1.18 from Medium to High
  • Added Zimbra Collaboration Suite (ZCS) Local File Inclusion check CVE-2025-68645

Release 20260129​

Release date: 29 January 2026
Version: 25.12.8

Security checks​

  • Updated the vulnerability database (VDB) to version 20260127
  • Improved XSS detection
  • Added vulnerability detection for e107:

Resolved issue​

  • Fixed notifications

Release 20260121​

Release date: 21 January 2026
Version: 25.12.7

Security checks​

Release 20260113​

Release date: 13 January 2026
Version: 25.12.6

Security checks​

Release 20260107​

Release date: 7 January 2026
Version: 25.12.5

Security checks​

  • Updated the Vulnerability Database (VDB) to version 20260106
  • Added 15 new versions for 18 technologies and 7 new CVEs
  • Updated severity ratings for MongoDB versions 4.2.18, 4.3.0-4.3.3, 4.4.29, 5.0.30-5.0.31, 6.0.23-6.0.26, 8.0.13-8.0.15, 8.2.0-8.2.1 from Medium to High
  • Updated severity rating for Podcast Generator version 3.2.9 from Medium to Critical
  • Updated severity ratings for Python versions 3.10.10-3.10.19, 3.11-3.11.14, 3.12-3.12.5 from High to Critical
  • Updated severity rating for Python version 3.12.6 from Medium to Critical
  • Added vulnerability detection for CrushFTP:
  • Added vulnerability detection for MongoDB:
  • Added vulnerability detection for Podcast Generator:
  • Added vulnerability detection for Python:
  • Added vulnerability detection for Roundcube:
  • Added vulnerability detection for phpMyFAQ:

2025​

Security checks, vulnerability database updates, and Runtime SCA enhancements released in 2025.

Release 20251230​

Release date: 30 December 2025
Version: 25.12.4

Security checks​

Improvements​

  • Updated vulnerability classifications to align with OWASP Top 10 2025 categories
  • Updated OWASP Top 10 scan profile to align with OWASP Top 10 2025 categories

Release 20251217​

Release date: 17 December 2025
Version: 25.12.3

Security checks​

Improvements​

  • Improved detection of DOM XSS vulnerabilities
  • Updated the alert text of the most detected vulnerabilities

Resolved issues​

  • Improved detection of "Sensitive pages could be cached" vulnerabilities
  • Improved detection of "Open Redirect" vulnerabilities

Release 20251209​

Release date: 9 December 2025
Version: 25.12.2

Security checks​

  • Updated the Vulnerability Database (VDB) to version 20251209

Release 20251205​

Release date: 5 December 2025
Version: 25.12.1

Security checks​

Release 20251203​

Release date: 3 December 2025
Version: 25.11.3

Security checks​

Improvements​

  • Improved password detection when leaked in responses
  • Improved detection of DOM XSS vulnerabilities

Resolved issues​

  • Improved detection of chatbots

Release 20251125​

Release date: 25 November 2025
Version: 25.11.2

Security checks​

  • Added detection for the Fortinet FortiWeb authentication bypass vulnerability (CVE-2025-64446)
  • Added detection for the Citrix NetScaler memory leak and reflected XSS vulnerability (CVE-2025-12101)
  • Improved detection of SQL injection attempts in prepared statements used with NodeJS and MySQL
  • Added detection for the Oracle Identity Manager authentication bypass leading to RCE (CVE-2025-61757)
  • Updated the Vulnerability Database (VDB) to version 20251125

Resolved issue​

  • Fixed an issue in the script that identifies API resources missing required authentication

Release 20251120​

Release date: 20 November 2025
Version: 25.11.1

Security checks​

  • Added check for Django SQL Injection via _connector parameter - CVE-2025-64459
  • Updated the Vulnerability Database (VDB) to version 20251118

Improvement​

  • Updated High Risk profile to include Blind XSS vulnerability checks

Release 20251105​

Release date: 5 November 2025

Security checks​

  • Improved Local Path Traversal detection in J2EE environments to cover CVE-2025-55752
  • Added detection for Magento authentication bypass (SessionReaper) - CVE-2025-54236
  • Updated the Vulnerability Database (VDB) to version 20251104

Improvements​

  • Improved detection of sensitive information and personally identifiable information (PII)

Resolved issues​

  • Resolved an issue where XSS findings in JSON responses didn't display attack details
  • Fixed the issue where sensitive data was not highlighted in the response for Sensitive Data Exposure vulnerabilities
  • Resolved classification of standard XSS vulnerabilities that depend on how legacy browsers handle encoding

Release 20251031​

Release date: 31 October 2025

Security checks​

  • Updated AEM (Adobe Experience Manager) checks to include seven newly reported vulnerabilities from the Hopgoblin toolkit (CVE-2025-54251, CVE-2025-54249, CVE-2025-54252, CVE-2025-54250, CVE-2025-54247, CVE-2025-54248, CVE-2025-54246)
  • Updated the Vulnerability Database (VDB) to version 20251006
  • Updated the Vulnerability Database (VDB) to version 20251021
  • Added detection for the Oracle E-Business Suite remote code execution vulnerability (CVE-2025-61882)
  • Added a new information discovery capability to detect sensitive or personally identifiable (PII) data during scans

Improvements​

  • Increased the severity level of TLS 1.1 usage from “Info” to “Low”
  • Added new informational XSS finding types for cases where exploitation depends on the encoding behavior of legacy browsers

Resolved issues​

  • Removed duplicate CVE findings