Release notes for 2026¶

v26.14.1 — 2026-08-07¶

Server part¶

Added¶

Added the addresses parameter to the POST /api/scans request, enabling the creation, binding, and launching of network target groups.

Changes¶

The parameter networks has been renamed to addresses for network target groups.

Scan modules¶

Bug fixes¶

Fixed an issue in the dynamic page analysis modules caused by a library name change that led to module crashes.

v26.14 — 2026-07-28¶

Dashboard¶

Added¶

The target list now includes information about each target's RPS limit.
Added the ability to hide optional columns in the General Scan List.
Added the ability to modify deduplication settings in the Create Scan Wizard.

Server part¶

Changes¶

Updated the OpenAPI documentation with current schemas for issues, targets, and scans, along with corresponding descriptions and examples.

Scanner fuchsiad¶

Added¶

Added support for upstream SOCKS5 proxies for network scan modules.
Added the ability to automatically launch web scans based on open ports discovered during network scanning (use the autoscan-web flag with the fuchsiactl network_scan command).

Dynamic web crawling module¶

Added¶

Added specialized handling for <a> elements with JavaScript code in the href attribute. Such elements are now processed as internal pages of the target URL.

Scan modules¶

Added¶

The experimental CORS misconfiguration module now includes issue deduplication.

Bug fixes¶

Fixed an issue due to which JSON request body keys were shown in the final report instead of the relevant payloads.

v26.13.1 — 2026-07-29¶

Server part¶

Changes¶

The public scan request schema has been updated.

v26.13 — 2026-07-14¶

Dashboard¶

Added¶

The target details page now includes:
- an “Issues” tab;
- a Severity Trend graph that reflects the severity level changes of the selected target.
Added the detection date for the issue within the scan to the scan issue details panel.

Changes¶

Added validation for the “Experimental Parameters” field in the New Scan Wizard. It is no longer possible to create a scan via the web interface with a configuration that is not supported by the scanner.

Server part¶

Added¶

Added the following requests:

/api/targets/{id}/issues/{id} — returns target issue details;
/api/targets/{id}/issues/{id}/scans — returns a list of scans in which the specified issue was found.
Added a history of severity level changes for issues within a scan.

Changes¶

For the /api/targets/{id}/issues request:
- added fields containing full information about the found target issues;
- added a short boolean parameter to retrieve information in a condensed form.
Clear error messages are now displayed when LDAP authentication errors occur.

Bug fixes¶

Fixed an issue with sorting that could appear when using pagination.
Fixed an issue where the target issue's createdAt field could be overwritten by later scans, and the updatedAt field did not always reflect changes to the issue mark.

Scanner fuchsiad¶

Added¶

TOTP codes can now be used with the browser script authentication refresh mechanism.
Added an enhanced page deduplication algorithm, disabled by default. To enable it, specify the following experimental parameters in the scan request: {"max_pages_number": <desired_pages_number>, "url_pattern_learning": {"emergency_collapse_floor": 1}}.

Bug fixes¶

Fixed an issue with fuchsiactl due to which the module list provided in the scan request was ignored.

Template analysis of resources and technology identification module¶

Added¶

Added templates to identify CopilotKit, Inkeep endpoints, and client-side code of AI libraries:
- Vercel AI SDK;
- CopilotKit;
- assistant-ui;
- Inkeep;
- Intercom Fin;
- AG-UI;
- LangChain;
- LangGraph UI.
Added the ability to specify the input_type parameter in templates to select the target entity for checking: resource, endpoint, or both. By default, templates are applied to resources.

Bug fixes¶

Fixed an issue that caused the module to hang during scans containing a high volume of resources.
Fixed a module crash caused by JoinError::Panic(..., "invalid node should not appear in real AST", ...) on invalid or incomplete JavaScript resources. Scanning now continues when this error occurs.

v26.12 — 2026-07-07¶

Dashboard¶

Added¶

The “Overview” tab on the scan details page now includes a summary of deduplication settings.
Added a “Bug fixes” tab to the issue details panel, describing general recommendations for addressing the issue. In the current version, the description is only available in English.

Bug fixes¶

Fixed an issue that prevented the “Issues” tab from appearing for discovery scans when issues were found.
Fixed links in the “Scans” card on the target details page. They now lead to a status‑filtered scan list for the selected target instead of the general scan list.

Server part¶

Added¶

Concurrent execution of multiple backend services is now supported.
Added support for network scans. To run one, specify "network-scan": true in the scan request. Currently, this functionality is only available to users with the super administrator role.

Bug fixes¶

Fixed an issue due to which scans containing modules not presented in the current distribution could not be retried.

PDF report generator¶

Changes¶

Improved PDF generation performance for large BLOBs. Large data is now shortened prior to report creation and labeled with “[truncated]”.

Scanner fuchsiad¶

Added¶

Added new fields to the scan request schema for interaction with the static web crawling module:
- staticCrawlerMaxDepth — specifies the maximum page crawling depth;
- staticCrawlerMaxLinks — specifies the maximum number of page visits.
Added the corresponding flags to the scan command in the fuchsiactl console client.

Static web crawling module¶

Added¶

Added the ability to pass scan depth and maximum page visit limit parameters to the module when launched via the scanner.

GraphQL endpoint detection module¶

Bug fixes¶

Fixed the “panic: runtime error: invalid memory address or nil pointer dereference” error that could occur:
- due to disabled introspection of the GraphQL schema;
- if the introspected GraphQL schema contained only read‑only or only write‑only queries.

Scan modules¶

Added¶

Added deduplication for payload information with identical obtained confidential data to the experimental IDOR scanner.
Added an experimental CORS misconfiguration detection module to the standard set of modules.

Changes¶

The experimental IDOR scanner now features enhanced HTTP status code handling. On receiving a 4xx error, it cycles through potentially insecure parameters until a non‑error response is returned. Further scanning is then carried out based on the refined request.
The Reflected XSS detection module now looks for vulnerabilities with Content Security Policy (CSP) disabled. If a vulnerability is successfully detected, the module additionally verifies it with CSP enabled.

Bug fixes¶

Fixed false positives in the experimental IDOR scanner that could occur when identical confidential data appeared in different parts of web application HTTP responses.

Network analysis modules¶

Added¶

Added a UDP service detection and fingerprinting module to the standard set of modules.

Distribution for Docker Compose¶

Added¶

Added support for passing TLS and mTLS configuration to the fuchsiad scanner via a file, the path to which is specified by the FUCHSIAD_TLS_CONFIG_FILE environment variable. Currently, a local proxy (e.g., Stunnel or GOST) must be set up to communicate with the backend.

v26.11 — 2026-06-16¶

Dashboard¶

Added¶

The target list in the Create Scan Wizard now displays a brief summary of each target's parameters.

Changes¶

In the Create Scan Wizard, target selection and scan type selection have now been combined into a single “General Info” step, allowing scans to be started quickly within a single step.

Bug fixes¶

Fixed an issue on the scan details page that prevented large issue lists from loading before the scan had finished.
For the issue details panel:
- fixed panel reloading when changing an issue's mark or severity level;
- fixed CVSS2 vector description generation, which could fail due to incorrect version detection.

Server part¶

Added¶

Added the PUT /api/scans/{id}/issues/{issueID}/status request, which changes the issue mark for the specified scan and all subsequent scans. For previously completed scans, the issue mark that was valid at the time of scanning is displayed.

Changes¶

The TimescaleDB extension for PostgreSQL has become optional in installations.
For each scan issue, the detection time within the specified scan is now displayed in addition to the first detection time.

Bug fixes¶

Fixed an issue due to which scan retries used the authentication data and specification from the original scan rather than the target's up‑to‑date settings.
Fixed an issue due to which domain restrictions were displayed incorrectly for super administrators when viewing group scans and targets from other organizations.
Fixed an issue due to which the browser authentication configuration was not cleared when sending the rewriteBrowserAuthRefresher: true flag in the PATCH /api/targets/{id} request.

PDF report generator¶

Added¶

Added information about technologies identified during the scan to the full PDF scan report.

Scanner fuchsiad¶

Added¶

Added support for extracting data from session storage to the authentication refresh mechanism using a browser script.

Changes¶

Traffic from authentication check and refresh mechanisms no longer contributes to scan RPS limit.
HTTP response bodies that do not match the authentication check criteria are now logged with a size limit of 1 MB. Larger bodies are truncated.

Bug fixes¶

Fixed the “panic: read |0: file already closed” error that could cause modules to crash.

SolidWall WAF integration module¶

Added¶

Added the ability to import a file containing endpoints exported from the SolidWall WAF interface.

Client-side JavaScript code analysis module¶

Bug fixes¶

Fixed an issue due to which the module would hang when the main page HTML code failed to load within the timeout period.

Added¶

Added the ability to detect login forms that accept a username instead of an email address as the login field.

Bug fixes¶

Fixed the “TypeError: container.$ is not a function” error that could cause the module to crash in rare cases when searching for a login form.

Template analysis of resources and technology identification module¶

Added¶

Added templates for detecting client-side AI agent code.
Added endpoint analysis support. In the current version, analysis is performed only for endpoint URLs.

Scan modules¶

Added¶

For modules that use the generalized API to perform time-based issue checks:
- added the ability to detect server degradation during scanning and adjust subsequent operations accordingly to minimize false positives;
- reports now include statistics that were used to determine whether a vulnerability exists.
Added time‑based issues checking to the SQL injection scanner using the generalized API with a statistical model.

Bug fixes¶

Fixed an issue due to which the Reflected XSS scanner would crash when processing endpoints with a content-type: application/json header and invalid JSON body. The fix now validates successful JSON body parsing while ignoring the content-type value.

v26.10 — 2026-06-02¶

Dashboard¶

Added¶

Added the ability to filter the target list by URL address.
The scan details page now includes a description field for the scan, which can also be edited.

Bug fixes¶

Fixed an issue that could cause the dashboard to crash when attempting to view long logs.
Fixed an issue in scan list filtering. The state of selected elements is now correctly remembered when the filter panel is closed.

Server part¶

Added¶

Added support for configuring deduplication.
Added validation for experimental parameters before sending them to the scanner.

Changes¶

Experimental parameters are no longer available for direct scans.

Bug fixes¶

Fixed an issue in PDF reports where the CVSS2 vector description generation could fail due to incorrect version detection.
Fixed an issue due to which experimental parameters could be used to set the URL and RPS limit.
Fixed an issue due to which domain restrictions were displayed incorrectly for super administrators when viewing targets from other organizations.

Scanner fuchsiad¶

Added¶

Added support for exceptions to the URL restriction list.

Changes¶

Improved compatibility with HTTP/2 reverse proxy servers.

Dynamic web crawling module¶

Changes¶

Logging has been overhauled:
- improved log readability;
- added log levels;
- added progress counters for actions and internal URLs.

Template analysis of resources and technology identification module¶

Added¶

Added the skip_if_label_matched parameter for Powby2 templates. If a signature label has already been found for a resource, subsequent entries with the same label are not checked.

Distribution for Docker Compose¶

Changes¶

Module configuration files are no longer copied to the locally mounted fuchsiad/config/pipeline.d directory when the fuchsiad service starts. To use a modified version of a file, place it in fuchsiad/config/pipeline.d. Such configuration will have priority over the default version.
Module versions can now be retrieved for installations (for example, using the fuchsiactl list_modules command).

v26.9 — 2026-05-19¶

Dashboard¶

Added¶

Added the ability to set a description in the Create Scan Wizard that will be applied to all scans in the group.
Added the ability to change the severity level of issues found during a scan.

Bug fixes¶

Fixed an issue where the dashboard would crash when viewing issue details if a large amount of data was being loaded.

Server part¶

Added¶

Added the ability to check whether logs exist for scan jobs.
Added support for statistics on HTTP status codes of scan responses.

Changes¶

Domain restrictions for organizations no longer apply to users with the super administrator role. Such users can now create targets and scans for targets that do not comply with the restrictions.
The configuration of the authentication check mechanism has been unified. It can now be passed as a customizable object or as an array of values.

Bug fixes¶

Fixed an issue due to which an attempt to retry a scan could be made on a disabled scan node.
Fixed an issue that occurred when generating a PDF report for a scan with no resources or endpoints.

PDF report generator¶

Changes¶

Report status has been changed to ERROR instead of retaining the last received status in cases where the report generation state has been lost due to a failure or restart of the PDF report generator.

Scanner fuchsiad¶

Changes¶

The number of new scans created using the NextScanProposal tag can now be limited using the --max-new-scans flag of the fuchsiactl rescan command (the default limit is 3).

Bug fixes¶

Fixed an issue due to which network analysis module versions were being detected incorrectly.

Scan modules¶

Added¶

Added additional information about payloads to the blind injection report in the NoSQL injection scanner.
The configuration for modules that use a headless browser now includes details about this dependency.
The experimental IDOR scanner can now accept custom email addresses to be used in attack vectors. The path to the file is specified using the --fileflag of the fuchsiactl scan command.

Changes¶

For the dynamic page analysis module, issue identifiers are now grouped by URL. To improve deduplication, only the host is now used to generate the identifier, instead of the full page URL.
The NoSQL injection scanner logging mechanism has been overhauled. Logs can now be generated in JSON format.

Network analysis modules¶

Added¶

The service fingerprinting module has been added to the standard module distribution.

Distribution for Docker Compose¶

Added¶

Environment variables for configuring the backend SMTP service can now be specified in the corresponding variables in the .env file.

v26.8.1 — 2026-05-13¶

Dashboard¶

Bug fixes¶

Fixed an issue due to which the scan request could be sent with a wrong list of modules when the custom scan type was selected.

Distribution for Debian¶

Bug fixes¶

Fixed an issue in the fuchsia.postinst post‑installation script that caused an invalid configuration file to be generated.

v26.8 — 2026-05-05¶

Dashboard¶

Added¶

Added the ability to generate PDF reports for incomplete scans.

Changes¶

The scan list can now be filtered by all available statuses.

Server part¶

Added¶

Added the DELETE /api/tenants/{id} request for deleting an organization.

Changes¶

For the GET /api/scans/{id}/jobs request, scan module jobs are now sorted by module name by default.

SolidPoint CLI Command line interface¶

Added¶

Added the scan show command to display information about a scan, including its jobs, resources, endpoints, and issues.

Changes¶

For the solidpoint-cli scan new-ci command, a --severity=never option has been added. This option allows the command to complete successfully even when issues are found.

PDF report generator¶

Added¶

Added module progress information to PDF scan reports.

Scanner fuchsiad¶

Added¶

Added the following to the browser authenticator:
- logging of HTTP requests, responses, browser console errors, and navigation events;
- an extra wait period after navigation to allow the page to load more completely.
Added a passive template analysis module and an experimental IDOR scanner.

Changes¶

Form data entered during browser script execution is now masked in the browser authenticator logs.

Bug fixes¶

Fixed an issue in the fuchsiactl list_scans command due to which the scan status showed PAUSED instead of CANCELED for paused scans that were canceled.

OpenAPI specifications import module¶

Bug fixes¶

Fixed a module crash when handling invalid URLs in specifications. Endpoints now use either the normalized version of the URL or http://127.0.0.1 (when running in CLI mode).

Added¶

Added the ability to automatically close pop-up dialogs and record the performed actions in the browser script.

Bug fixes¶

Fixed an issue due to which the module failed to use the specified RPS parameter and did not record requests in the logs.

Scan modules¶

Added¶

The Reflected XSS scanner can now inject payloads into JSON request bodies.

Bug fixes¶

Fixed an issue in the Nuclei active template analysis module where identical identifiers could be generated for the same issues across different scan targets.
Fixed a false positive in the NoSQL injection scanner that could occur in the case of a blind injection into a key name.

v26.7 — 2026-04-21¶

Warning

After upgrading to this version, clear the browser cache. Upon initial login to the dashboard, refresh the page (Ctrl + R) for correct functionality.

Dashboard¶

Added¶

Super administrators have been granted expanded permissions to interact with targets from other organizations:
- added the ability to repeat scans of such targets;
- added the ability to launch scans from the target list and the target details page.
To the scan details page added:
- a tab with extended information about the modules participating on the scan to the scan details page;
- the “Experimental Parameters” tab, containing information about the experimental parameters using which the scan was performed (only displayed if such parameters were specified when the scan was created).

Server part¶

Added¶

For endpoints in the scan details and in the raw scan report, the issues_only query parameter has been added. It allows filtering resources and endpoints that contain issues.
A description field has been added to the public scan model. To change the description, use the PATCH /api/scans/{id} request.
An OpenAPI specification can now be provided via a link.

Bug fixes¶

Fixed an isue due to which string parameter restrictions were not displayed in the GET /api/restrictions/string-params request.
For the /api/scans/{id}/resources/{id} and /api/scans/{id}/deps/{id} requests, the error code when a scan, resource, or endpoint is missing has been changed from 422 to 404.

SolidPoint CLI Command line interface¶

Added¶

Added the ability to work with multiple installations simultaneously within a single CLI.

PDF report generator¶

Added¶

Added CVSS vector descriptions for found issues in PDF reports.

Scanner fuchsiad¶

Added¶

Added support for simple endpoint deduplication mode to the fuchsiactl console client.

Changes¶

Optimized the use of active connections for the internal proxy.

Static web crawling module¶

Bug fixes¶

Fixed a logging issue in dirbusting due to which the base URL was logged instead of the discovered ones.
Fixed a configuration handling error when using the simple endpoint deduplication mode.

OpenAPI specifications import module¶

Added¶

Added support for an internal proxy.

Scan modules¶

Added¶

Added support for network scans.
The standard distribution now includes the first network scanning module: the open port detection module. This module is responsible for scanning the network to identify open TCP ports.

Bug fixes¶

Fixed an issue in the Nuclei active template analysis module where multiple reports with the same identifier could be created for a single template. Such issues are now merged into a single report that includes all attack vectors from the deduplicated original reports.
Fixed client and server process issues in the SQL injection scanner that led to module freezes.

Distribution for Docker Compose¶

Added¶

Added support for network scans launched via the fuchsiactl console client.

v26.6 — 2026-04-07¶

Dashboard¶

Added¶

Added the ability to modify query parameters when viewing logs of scan modules that have not yet completed: the maximum number of logs displayed simultaneously and the request frequency. The default setting displays 100 logs and refreshes every 5 seconds.
Added an “Experimental Parameters” step to the Create Scan Wizard.
Added pop-up notifications for server errors (when the backend is unavailable) to the registration and authentication pages.
Added filtering by scan type to the main scan list.
Added filtering by status and scan type to the scan list of the target.

Bug fixes¶

Fixed an issue due to which target data was updated with a delay when edited on the target details page.

Server part¶

Added¶

Added a duration field to requests that display scan module job information. This field contains the actual runtime of the module (excluding pause time).

Bug fixes¶

Fixed log count calculation issue for the GET /api/scans/{id}/jobs/{jobID}/logs request with the count parameter.

Scanner fuchsiad¶

Added¶

Added the ability to exclude specific modules or module groups when starting a scan using the fuchsiactl console client.
Added an optional min_pages_number parameter to the page deduplication settings. It allows specifying a threshold for the number of application pages obtained from the endpoint discovery (default: 10). When this threshold is exceeded, automatic page deduplication is enabled. Deduplication will not be enabled automatically if it has been disabled manually.

SolidWall WAF integration module¶

Added¶

Added the ability to pass the scanned web application identifier via additional settings, allowing the WAF to uniquely identify it.

Client-side JavaScript code analysis module¶

Bug fixes¶

Fixed an error that could cause the Host header to be lost in endpoints, leading to incorrect deduplication behavior.

Scan modules¶

Added¶

Added a description of the detected issue to the shell injection scanner reports.

Changes¶

The kernel version of Nuclei has been updated to 3.7.1.

Bug fixes¶

Fixed incorrect display of payloads with delays in the SSTI scanner report details.

v26.5.1 — 2026-03-30¶

Server part¶

Bug fixes¶

Fixed an issue due to which target deletion was not working correctly.
Fixed super administrator scan permissions for targets in other tenants.

v26.5 — 2026-03-24¶

Dashboard¶

Added¶

Added the ability to generate PDF reports in Turkish and Portuguese.
Added the ability to view scan module logs.

Changes¶

Target creation has been simplified. After filling in the “Address” field, the target can be saved. Subsequently, all parameters except the address are available for editing.

Server part¶

Added¶

Added TLS support for the SMTP client.

Changes¶

The super administrator can now create scans, targets and scan groups in other tenants.
In the GET /api/scans/{id}/jobs request the progress parameter is now provided.

SolidPoint CLI command line interface¶

Added¶

For the solidpoint-cli scan new-ci command added the --summary, -s flag, which controls that the scan report will only be output at the end of the command execution.

Scanner fuchsiad¶

Added¶

Added automatic search for the fuchsiactl console client configuration file in the directory specified by the FUCHSIAD_CONFIG_DIR environment variable if it is not found in the standard directories.

Changes¶

The scanner no longer uses post-quantum encryption algorithms in TLS when connecting to the target web application to avoid compatibility issues.

OpenAPI specifications import module¶

Added¶

The specification file is now also searched for at the /swagger-json path.

Scan modules¶

Added¶

Added a page freeze detection mechanism for the Stored XSS detection module. If a freeze occurs, processing of the current URL will be aborted.
For the SSTI scanner:
- added the -level flag, which controls the use of system commands within attack vectors (the higher the level, the more commands are used during the attack);
- added support for the EJS, ERB, Nunjucks and Velocity template engines;
- added payloads for the Pug, Slim, Smarty and Vue template engines.

Bug fixes¶

Fixed missing CVSS vector versions in the following modules:
- the path traversal vulnerability scanner;
- the controlled serialized data detection module;
- the CSPP scanner;
- the shell injection scanner.
For the SSTI and shell injection scanners fixed the “error while striking: Invalid URL in HAR” error that occurred when scanning endpoints with paths that included the UNKNOWN special value.

v26.4.1 — 2026-03-24¶

Server part¶

Bug fixes¶

Fixed an issue due to which GET /api/scans/{id}/raw-details-report request could fail to provide endpoints and resources when no issues were found in the scan.

v26.4 — 2026-03-10¶

Dashboard¶

Added¶

Added information about target request limit to the scan details page.

Changes¶

In the Create Scan Wizard the list of modules is now displayed directly at the Scan Type step for the custom scan type.

Server part¶

Added¶

Added additional requests for managing resources and endpoints:
- GET /api/scan/{id}/deps/{id};
- GET /api/scan/{id}/resources/{id};
- GET /api/scan/{id}/deps/count;
- GET /api/scan/{id}/resources/count.
Added a GET /scans/{id}/override-config request for retrieving experimental parameters.
Added a boolean field hasOverrideConfig to the GET /api/scans/{id} request, indicating whether experimental parameters are in the scan.

Changes¶

The default value for the maximum scanner message size has been changed from 50 MB to 100 MB (SCANNER_MAX_CALL_RECV_MSG_SIZE_MB environment variable).
The GET /api/scans/{id}/raw-details-report request now displays current issue statuses for tags with the type: IssueFound parameter.

Bug fixes¶

Fixed character length validation for string fields when creating users, targets, and tokens.
Fixed an issue due to which a scan that had terminated on the scanner in some cases could remain in the Pausing state on the server part.

Scanner fuchsiad¶

Bug fixes¶

Fixed an issue that caused duplicate scans to be created when using the rescan --login-proposal command.
Fixed excessive memory consumption when saving request and response bodies during web socket operations.

OpenAPI specifications import module¶

Added¶

Added automatic checking of standard paths for the presence of a specification file.

Client-side JavaScript code analysis module¶

Changes¶

Improved stability of the analyzer for web applications using Webpack.

GraphQL endpoint detection module¶

Bug fixes¶

Fixed an issue that caused variable types in the variables section for endpoints to be converted to string.

Scan modules¶

Added¶

For the dynamic page analysis modules that detect DOM XSS added a restriction list that filters data streams before they are included in the report.

Changes¶

The Powby2 passive template analysis module moved to the discovery module list

Distribution for Debian¶

Added¶

Added support for Astra Linux 1.8.

v26.3 — 2026-02-24¶

Dashboard¶

Added¶

Added an “Risk accepted” mark for issues. This mark is used to indicate confirmed issues that do not require fixing. Issues with this mark are excluded from subsequent scans of the target.

Changes¶

The dashboard is now more compact and fits more information on the screen.
For scan details:
- updated the design of the scan endpoints list;
- the endpoints list now uses row virtualization;
- optimized data loading on the page.

Bug fixes¶

Fixed an error in issue details due to which unreadable characters were displayed in the “Details” field on the “Validation” tab.

Server part¶

Added¶

Added support for the riskAccepted mark.
Added scan status history.
Added brief information about identified technologies to the GET /api/targets/{id} request.
Added GET /api/scans/{id}/resources and GET /api/scans/{id}/deps requests. These endpoints enable the separate retrieval of information about resources and endpoints for a specified scan.
Added module validation and improved error handling for direct scans. A scan is classified as “direct” when created via a POST /api/scans request with the raw parameter specified. No target creation is needed for this type of scan; its parameters are set in accordance with the scanner's supported schema.
Added handling for module jobs missing from the current installation in scans created via synchronization. These jobs now utilize the job name rather than the module name.
Added the GET /api/scans/{id}/software-versions/count request to retrieve the number of software versions in a scan.

Bug fixes¶

Fixed handling for the confirmed, fixed and regression marks.
Fixed an issue that prevented saving a target with an empty name and description.

SolidPoint CLI command line interface¶

Added¶

Added validation for interactive input.
Added mode checking for commands. If a command designed for multi-user mode is executed in single-user mode, a clear error message is displayed.

Changes¶

Updated and improved command descriptions in the help documentation.

Bug fixes¶

Fixed an issue due to which the solidpoint-cli scan cancel command did not function.

Client-side JavaScript code analysis module¶

Added¶

Added an external analyzer timeout. It ensures the analyzer process terminates within an acceptable time frame regardless of the correctness of its code.
Improved support for code that is divided into modules via a module bundler.

Scan modules¶

Changes¶

Updated the Nuclei public templates to the current version.

v26.2.1 — 2026-02-13¶

Scan modules¶

Bug fixes¶

For dynamic page analysis modules, fixed a YAML configuration issue that was breaking interaction with shell.

v26.2 — 2026-02-10¶

Dashboard¶

Added¶

The target details page now includes a tab showing a list of scans for selected target.
Added filtering by scan status to the scan list.

Changes¶

Removed the quick scan creation modal window.

Bug fixes¶

Fixed an issue due to which the JSON file downloaded from the Raw Scan Report page contained an endpoints list instead of deps.

Server part¶

Added¶

For GET /api/scans/{id} request added information about identified technologies.
For GET /api/scans/{id} and GET /api/scans added a counter for the number of generated PDF reports.

Changes¶

For GET /api/scans/{id} request scan jobs are now sorted not only by module type but also by execution start time. For GET /api/scans/{id}/jobs request this sorting can be applied using a withTypeAndTimeSort=true query parameter.

Bug fixes¶

Fixed a database connection issue that could occur during migration.
Fixed an issue due to which the list of identified technologies was not updating during the scan for GET /api/scans/{id} request.

Scanner fuchsiad¶

Added¶

Added the experimental automatic login module to the standard package.
Added the ability to save server responses during scanning.

Changes¶

Active scans are now paused (not canceled) on scanner shutdown and auto-resume on restart.

Bug fixes¶

Fixed a scan statistics calculation issue that caused the request counter in the dashboard to stop and the fuchsiactl scan_stats command in the console client to fail.

OpenAPI specifications import module¶

Changes¶

Improved endpoint discovery by refining the endpoint generation mechanism.

Client-side JavaScript code analysis module¶

Added¶

Added an internal timeout system. A “soft” timeout is supported: when it is triggered, the analysis stops and a result based on the collected data is returned.
Improved endpoint discovery for web applications using Webpack.

Scan modules¶

Added¶

For the Powby2 passive template analysis module, added support for Wappalyzer signatures of the requires_category type.

Changes¶

Dynamic page analysis modules are now split into 4 services: dynamic-page-analyzer-domxss-pages, dynamic-page-analyzer-domxss-tags, dynamic-page-analyzer-cspp-pages, dynamic-page-analyzer-cspp-tags. This is necessary for correctly pausing scans and for operation in the experimental breadth-first scan mode.

Bug fixes¶

In the SSTI and Shell Injection scanner report details, the payload is now correctly displayed when a vulnerability was found in a key.
Implemented a check based on a delayed response from the server in the SSTI scanner using a generalized API and a statistical model.

v26.1 — 2026-01-27¶

Dashboard¶

Added¶

On the scan details page:
- added information about the scan status at the time of PDF-report generation to the Reports tab;
- added information about the identified technologies during the scan of the target.
Added information about additional authentication data to the target details page.

Changes¶

All PDF-report bulk operations are temporarily hidden in the Reports tab.
Tabs without data are hidden in the details of completed scans.
The Reports tab is now available only for completed scans if at least one issue is identified.

Bug fixes¶

Fixed an issue in handling endpoints where data of a non-string type was received.

Server part¶

Changes¶

Registration and account activation notifications sent via email now support Chinese.

Bug fixes¶

Fixed an issue that could cause scan job logs to download incompletely.
Fixed an issue due to which filtering by scan status might not work.

Scanner fuchsiad¶

Added¶

Added the ability to open a Go pprof endpoint (by default disabled). The scanner configuration file requires a value for the pprof_address field.

Client-side JavaScript code analysis module¶

Added¶

The initiator field now includes a complete call stack for dynamically sent requests.

Changes¶

Invalid HTTP methods are now excluded from discovered endpoints.
Enhanced the limitations on objects generated by the analysis to decrease the rate of false positives.

Scan modules¶

Changes¶

Improved Nuclei templates for CVE-2025-55182. Added new payloads for vulnerability validation.

Bug fixes¶

For the OpenAPI specification import module, fixed the header value type for endpoints. It is now always a string.
Fixed incorrect selector display for vulnerabilities in parameter names.
Fixed the way vulnerabilities are detected using payloads with delays, that caused false positives. Affects the following modules:
- the PHP untrusted data deserialization scanner;
- the shell injection scanner;
- the unsafe deserialization in Java scanner;
- the file upload vulnerability scanner.

Distribution for Docker Compose¶

Changes¶

Installation updates now run without additional interactive prompts.

Release notes for previous year

Release notes for 2026¶

v26.14.1 — 2026-08-07¶

Server part¶

Added¶

Changes¶

Scan modules¶

Bug fixes¶

v26.14 — 2026-07-28¶

Dashboard¶

Added¶

Server part¶

Changes¶

Scanner fuchsiad¶

Added¶

Dynamic web crawling module¶

Added¶

Scan modules¶

Added¶

Bug fixes¶

v26.13.1 — 2026-07-29¶

Server part¶

Changes¶

v26.13 — 2026-07-14¶

Dashboard¶

Added¶

Changes¶

Server part¶

Added¶

Changes¶

Bug fixes¶

Scanner fuchsiad¶

Added¶

Bug fixes¶

Template analysis of resources and technology identification module¶

Added¶

Bug fixes¶

v26.12 — 2026-07-07¶

Dashboard¶

Added¶

Bug fixes¶

Server part¶

Added¶

Bug fixes¶

PDF report generator¶

Changes¶

Scanner fuchsiad¶

Added¶

Static web crawling module¶

Added¶

GraphQL endpoint detection module¶

Bug fixes¶

Scan modules¶

Added¶

Changes¶

Bug fixes¶

Network analysis modules¶

Added¶

Distribution for Docker Compose¶

Added¶

v26.11 — 2026-06-16¶

Dashboard¶

Added¶

Changes¶

Bug fixes¶

Server part¶

Added¶

Changes¶

Bug fixes¶

PDF report generator¶

Added¶

Scanner fuchsiad¶

Added¶

Changes¶

Bug fixes¶

SolidWall WAF integration module¶

Added¶

Client-side JavaScript code analysis module¶

Bug fixes¶

Automatic login module¶

Added¶