LoginSign Up
← Back to all sparks
G

Greenbone Vulnerability Manager

INFRA · APIS
Velocity5.0

Vulnerability scanning and management service behind the Greenbone security stack

www.greenbone.net ↗

Greenbone GVM adds web application VT scanning and async report export scheduling

vulnerability-managementweb-securityzapopenvasreportingoci
◆Current state
Greenbone Vulnerability Manager (gvmd) has shipped four feature releases in roughly six weeks, centering on two themes: web application vulnerability scanning (ZAP VTs loaded into the database as a new 'Web Application VT' subtype) and report export infrastructure (async scheduling, polling, GMP command support). The integration of OWASP ZAP vulnerability tests into GVM's VT database is the most directional change — it extends GVM's scanning coverage beyond network and host vulnerabilities into web application-layer findings.
◆Where it's heading
GVM is building toward a more comprehensive vulnerability management platform that covers web applications alongside traditional network targets. The ZAP VT integration (v26.35.0) and the dedicated web_application_vt GMP subtype suggest this is a strategic integration rather than a one-off import. Report export scheduling (v26.37.0–26.38.0) addresses a real operational need for teams that need to push findings to external systems on a schedule rather than on-demand. Agent application severities and OCI image target improvements show the platform expanding into container and agentic workload scanning.
◆Prediction
The ZAP VT subtype will gain dedicated reporting and filtering capabilities in the next few releases, since the data model is now in place but the UI and workflow support will need to catch up. OCI image scanning is likely to get more depth given the ongoing container target improvements.

◆Recent moves

  1. 9d ago

    gvmd 26.38.0

    gvmd 26.38.0 completes the report export pipeline with async polling and scheduling — operators can now schedule report exports as recurring jobs and poll for completion rather than waiting synchronously. The release also adds agent application severity tracking and per-OCI-target image count limits. This builds on the export infrastructure laid in 26.37.0.

    View source ↗
  2. 16d ago

    gvmd 26.37.1

    A single bugfix to init VTs without requiring Web Application VTs to be present — a startup correctness fix that prevented VT initialization in environments where the ZAP VT feed hadn't been loaded yet.

    View source ↗
  3. 20d ago

    gvmd 26.37.0

    gvmd 26.37.0 lays the database infrastructure for async report exports — a new report_exports table and GMP management commands. This is the data layer that 26.38.0's scheduling and polling builds on. Separately, audit report host data gets dedicated GMP support, improving visibility into per-host findings in audit workflows.

    View source ↗
  4. 1mo ago

    gvmd 26.36.1

    Updates the openvasd library dependency from version 23.3 to 23.9. Pure dependency maintenance with no feature changes.

    View source ↗
  5. 1mo ago

    gvmd 26.36.0

    Adds GMP support for audit report hosts (get_audit_report_hosts command), enabling programmatic retrieval of per-host audit findings. Also renames the report export infrastructure ahead of the 26.37.0 schema additions. A meaningful API surface expansion for automation workflows.

    View source ↗
  6. 1mo ago

    Greenbone GVM 26.35: OWASP ZAP Web Application VTs Added to Scanner

    ⚡ SPARK

    gvmd 26.35.0 loads OWASP ZAP vulnerability tests into GVM's VT database as a new 'Web Application VT' subtype, with a dedicated GMP get_info subtype for querying them. This extends GVM's coverage from network and host vulnerabilities into web application-layer findings for the first time — a meaningful capability expansion that changes what GVM can cover in a unified scan.

    View source ↗