Qualys Web Application Scanning

No entries match these filters. Clear filters

1. changelog Oct 28, 2026 · issue 124
   • New vulnerability check CVE-2026-111497 Brotli decompression flaw
2. changelog Oct 5, 2026 · issue 096

   Qualys TotalAppSec achieves FedRAMP HighFedRAMP HighA US federal authorization tier for cloud services, managed by GSA, certifying that a provider meets the strictest NIST 800-53 controls required to handle the most sensitive unclassified government data. authorization with continuous API discovery, BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data./BFLABFLABroken Function Level Authorization, an API vulnerability class where an application fails to enforce access controls on specific endpoints, letting lower-privileged users call admin or restricted functions./BUA testing, and TruRisk prioritization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Qualys TotalAppSec is now FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. High Authorized on the Qualys Government Platform (Class D, package FR2231052341), enabling organizations to inherit controls from an agency-accepted boundary.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Continuously discovers known, unknown, shadow, zombie, and rogue web apps and APIs across cloud, on-premises, internet-facing environments, API gateways, AI-serving endpoints, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers.
   • Imports API specs from Swagger, Postman, and Burp, pulling from gateway and cloud connectors, and reconciles every discovered endpoint against the declared inventory to surface shadow and zombie APIs.
   • Tests running applications and APIs for OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 risks, sensitive-data exposure, and authorization flaws — broken object level authorization (BOLA), broken function level authorization (BFLA), and broken user authentication (BUA) — that carry no CVE.
   • Authenticates test sessions with OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms., Proof Key for Code ExchangeProof Key for Code ExchangeProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier. (PKCEPKCEProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier.), bearer tokensbearer tokensA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else., and API keys to reach everything a legitimate caller can access.

   +4 more show less

   • Deep-learning detection catches zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. web malware with no existing signature.
   • AI-Powered Scan Optimization cuts scan time by up to 50 percent to make the daily scanning cadence required by FedRAMP at High impact achievable.
   • TruRisk prioritization engine ranks findings by severity, exploitability, threat context, asset criticality, and business impact, and ingests results from third-party AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. tools and pen tests into a single remediation queue.
   • Routes findings into CI/CD pipelines, Jira, and ServiceNow, with automatic retest after remediation and scheduled evidence output for FedRAMP controls SA-11, RA-5, SI-2, CM-8, and CA-7.

   9 details in Everything