OWASP ZAP · Issues· 861 open
Open on GitHubLocally synced open issues (discussions stay on GitHub)
- #9471
Modern spider doesn't respect the specified time limit
bugUpdated Sep 18, 2026 - #4393
Enhancement: Allow "Tools" (eg: Fuzzer) to opt-in to passive scanning on a per-use/run basis
enhancementUsabilityUpdated Sep 18, 2026 - #9426
[Site-tree] Add newly found subdomains and links as node to Sites without visiting the url.
marketplaceUpdated Sep 17, 2026 - #9461
UserControlledHTMLAttributesScanRule meta handing lacks minimum length guard leading to false positives
FalsePositiveadd-onin:pscanrulesUpdated Sep 17, 2026 - #9463
Add support for HTTP/3
enhancementadd-onin:networkUpdated Sep 15, 2026 - #9428
Unable to connect to httpforever.com, natas0.natas.labs.overthewire.org due to ZAP's http header changes
Updated Sep 15, 2026 - #9184
SourceCodeDisclosureFileInclusionScanRule should not mix `4xx` responses with `200` responses when performing analysis
bugFalsePositiveadd-onin:ascanrulesBetaUpdated Sep 15, 2026 - #9233
AI Analysis Engine
marketplaceUpdated Sep 14, 2026 - #6384
Expose Active Scan Filters in ZAP API
enhancementComponent-APIUpdated Sep 8, 2026 - #8987
LLM should use ZAP's networking instead of Java's
Type-Taskadd-onin:llmUpdated Sep 8, 2026 - #9450
gRPC add-on fails to handle native application/grpc bodies because VariantGrpc assumes Base64
bugadd-onin:grpcUpdated Sep 7, 2026 - #6162
macOS distribution is not from a verified developer
Type-TaskOpSys-OSXbacklogUpdated Sep 7, 2026 - #8856
Addon SOAP is not working properly when active scan is invoked by API
bugUpdated Sep 7, 2026 - #9445
Session persistence fails with HSQLDB RowInputBinary / EOFException due to corrupt HISTORY index
enhancementUpdated Sep 4, 2026 - #2000
General - Fix Title Caps
help wantedComponent-UIIdealFirstBugType-Tasktrackergood first issueUpdated Aug 31, 2026