BlogOpen a Ticket
Changelog
Back to All

Invicti ASPM Release v1.113.0 — 5th August, 2026

about 1 month ago by Ivana Stastna

Invicti ASPM v1.113.0 released!

New Features

  • Vulnerability Prioritization Funnel - A new interactive bubble-cloud visualization has been added to the Global, Project, and Product AppSec pages for admin users. The funnel shows how vulnerabilities flow through five progressive stages — All Vulns, Deduplicated, Confirmed, Exploitable, and Actionable — with animated stage transitions, clickable stage filters, and a detailed stats panel. Each stage is isolated per page to prevent state bleed when navigating between projects or products.
  • VEX import, apply, export and automation — Full VEX (Vulnerability Exploitability eXchange) lifecycle support has been added. Teams can import OpenVEX documents per project, create manual VEX statements, and export active statements as a standard OpenVEX document. Scanner-reported VEX data from JFrog Xray, Mend, Snyk, DependencyTrack, Sonatype, and the custom scanner template is now automatically ingested. CISA VEX states are mapped to triage actions (FP/TP/WF/RA) and applied via AMAN automation, with a per-project serialized apply queue and audit trail.
  • Cloud Assets Summary dashboard — A new Cloud Assets Summary dashboard has been introduced, providing a consolidated overview of cloud asset findings. The gateway route, supporting indexes, and UI design have all been added in this release.
  • Snyk SCA reachability — Snyk reachability data is now ingested and surfaced for vulnerabilities. Both the CLI import path (snyk test --json) and the Snyk API path (v1 aggregated-issues priority.factors and REST coordinates[].reachability) are supported, fixing a long-standing case mismatch bug that caused zero detection in the API path.
  • JFrog Artifactory artifact support — JFrog Xray SCA integration now supports listing and selecting specific Artifactory artifacts for scanning. The UI exposes artifact path and repository type selection, with filtering and pagination.
  • Qualys VMDR scheduled scans — Qualys VMDR integration now supports scheduled scan configuration, allowing teams to define recurring scan schedules via schedule_id directly from the integration settings UI.
  • SARIF level mapping configuration for SAST scanners — A new UI section in SAST scanner integration settings allows teams to map SARIF severity levels to ASPM severity levels, with an optional per-scanner enforce_scanner_severity flag.
  • DAST confirmed findings auto-triaged as true positives — Confirmed DAST findings are now automatically triaged as true positives, streamlining the review workflow for verified DAST results.
  • AWS ECR and Azure ACR registry authentication for Trivy — Trivy scanner configuration now supports AWS ECR and Azure ACR private registry credentials, enabling scans of images hosted in cloud-native container registries.
  • Regex operators and scanner type field in grouped vulnerability filters — The vulnerability grouped filter now supports =rgx= and =nrgx= (regex / negative regex) operators, enabling pattern-based rule matching. A new scannerType field has also been added, allowing filter rules to target specific scanner tool types via a multi-select enum picker.
  • Correlated field in DAST and SAST vulnerability detail — The “correlated” field is now displayed in the tool-specific sections of the vulnerability detail panel for both DAST and SAST findings, providing direct visibility into correlation status without navigating away from the detail view.
  • License error messages on login page — License-related errors (such as expired or invalid licenses) are now surfaced directly on the login page rather than being silently swallowed, giving users immediate feedback on why authentication was blocked.

Improvements

  • 4me issue tracker bulk sync — 4me’s per-vulnerability GET fan-out has been replaced with a single bulk request per project, reducing API calls from ~23k per sync cycle to one — staying well within the 3,600 req/hour rate limit and eliminating 429 errors.
  • Infrastructure group name filter chips in active filters bar — When infrastructure group name or severity filters are active, filter chips are now shown in the active filters bar on ScanAppSec and ScanInfra pages, making it easier to see and clear applied filters at a glance.
  • ExploitAvailable field propagated to top-level vulnerability — The ExploitAvailable flag is now propagated to the top-level vulnerability domain object, making it accessible for filtering and display without requiring a sub-document lookup.

Bug Fixes

  • EPSS filter not applied in AMAN automation trigger rules — The EPSS filter was not being evaluated when AMAN automation rules were triggered, causing rules with EPSS conditions to match vulnerabilities they should have excluded.
  • Runtime exposure Mongo timeout and query performance — The runtime exposure endpoint was hitting Mongo timeouts due to an O(vulns×endpoints) regex fan-out pattern. The query has been rewritten with AllowDiskUse and DAST/SAST counts decoupled to prevent cascading timeouts.
  • Correlation rule matching for All-scanner scope and scanner filter — Correlation rules targeting the All-scanner scope or using scanner-specific filters were not matching correctly due to a logic error in the rule evaluation path.
  • Project action menu button visibility behind permission gate — The project action menu button was incorrectly hidden when wrapped in a permission gate even for users with sufficient permissions. The visibility logic has been corrected.
  • Funnel state not cleared on logout — Vulnerability funnel state was persisted in memory across sessions, causing stale funnel data to appear briefly after logging in as a different user. Funnel state is now reset on logout and cached per user on the backend.
  • VEX tab stale project data on prev/next navigation — Navigating to the next or previous project from the VEX tab left the layout header, page title, and tab permissions showing the previous project’s data. The route watcher now correctly triggers a getProjectDetails call on project change.
  • Jira Assigned Teams dropdown missing options when custom_variables is null — The customIssueTypesListOptions guard in the Jira integration view incorrectly short-circuited when custom_variables was null, preventing option.options from being evaluated. The check order has been corrected, restoring the full team list in the dropdown.
  • Long file paths clipped without tooltip in vulnerability detail panel — File name and path values in SAST, IaC, SCA, CS, and IAST detail components were truncated by an ellipsis CSS rule with no way to read the full value. Tooltips have been added matching the pattern already used in the vulnerability table view.
  • Column Settings modal crash on stale localStorage column data — Saved column configurations referencing column dataIndex values that no longer exist in the current build caused a crash when opening the Column Settings modal. Stale entries are now filtered out before the modal renders.
  • nginx base image security update — The production Docker image has been upgraded to nginx-unprivileged:1.31.3-alpine3.24-otel, resolving two high-severity CVEs (CVE-2026-6276, CVE-2026-5773) that were blocking the container security gate.