All pull requests

Pull requests

• soap: Add example alert for WSDL File Detection

  #7861·tommyquak opened Oct 29, 2026·

  ·
  4

• ascanrulesBeta: Add example alert for OutOfBandXssScanRule

  #7859·Supersaiyan101 opened Oct 28, 2026·

  ·
  2

• mcp: cap alert instances per page, add pagination to zap://alerts/{ref}

  #7858·shivammm21 opened Oct 28, 2026·

  ·
  1

  3

• authhelper: auth_on_failure keep last step not only error step

  #7855·kingthorin opened Oct 27, 2026Member·

  ·
  3

• pscanrules: CSP rule now includes missing or wildcard base-uri

  #7847·kingthorin opened Oct 25, 2026Member·

  ·
  2

• commonlib: Update solutions and references for WASC-24, WASC-25, WASC-42, and WASC-47

  #7845·Supersaiyan101 opened Oct 24, 2026·

  ·
  9

• llm: add a per-message nonce to the untrusted data delimiters

  #7843·Yeagerist0 opened Oct 23, 2026·

  ·
  3

• pscanrules: apache version checks

  #7842·psiinon opened Oct 23, 2026Member·

  ·
  2

• automation: Support batch plans

  #7833·psiinon opened Oct 21, 2026Member·

  ·
  1

• Update various dead and redirect links

  #7825·kingthorin opened Oct 19, 2026Member·

  ·
  5

• pscan: Count queued messages in records to scan

  #7822·denissajnar-qbit opened Oct 18, 2026·

  ·
  1

  6

• client: count allowed resources in adaptive wait

  #7805·thc202 opened Oct 13, 2026Member·

  ·
  1

  10

• reports: Include the number of actively scanned nodes in the Modern report

  #7803·liotur opened Oct 12, 2026·

  ·
  1

  4

• ascanrules: Reduce false positives in the Spring Actuator scan rule

  #7801·liotur opened Oct 12, 2026·

  ·
  1

  7

• oast: generate Interactsh identifiers using native alphabets

  #7799·si1k opened Oct 10, 2026·

  ·
  1

• ascanrulesBeta: fix OOB XSS event-handler payloads

  #7798·si1k opened Oct 9, 2026·

  ·
  1

  1

• oast: support verified HTTPS callbacks without changing generic payloads

  #7796·si1k opened Oct 9, 2026·

  ·
  10

• oast: Handle unavailable callback addresses

  #7786·sainadh777 opened Oct 4, 2026Contributor·

  ·
  1

  1

• GSPM Rule Set UI

  #7755·psiinon opened Sep 25, 2026Member·

  ·
  8

• zest: avoid double encoding request URLs

  #7723·henrocdotnet opened Sep 14, 2026·

  ·
  6

• techdetect: Further naming adjustments

  #7722·kingthorin opened Sep 11, 2026Member·

  ·
  4

• soap: Add missing getLeafName method in VariantSoap

  #7711·FediJlassi opened Sep 7, 2026Contributor·

  ·
  1

  16

• grpc: handle native grpc binary

  #7708·hideintheclouds opened Sep 7, 2026·

  ·
  7

• soap: Enforce Mode & restrict resolutions

  #7684·kingthorin opened Aug 28, 2026Member·

  ·
  1

  13

• encoder: Support inline/chaining encoder operations in any Swing JTextComponent

  #7683·ArkhaMahn opened Aug 27, 2026·

  ·
  21