Issues

• Out-of-band XSS sends malformed event-handler payloads

  add-onbugin:oast
  zaproxy/zaproxy#9494 · Filter by author si1k opened on Oct 9, 2026
  3

  

• Interactsh HTTPS callbacks fail TLS validation and event parsing

  add-onbugin:oast
  zaproxy/zaproxy#9493 · Filter by author si1k opened on Oct 9, 2026
  

• Add active scan rule for invalid monetary amounts accepted by an API

  add-onenhancementin:ascanrulesAlpha
  zaproxy/zaproxy#9491 · Filter by author alienatix opened on Oct 5, 2026
  2

  

• Selenium throws a lot of Java-Exceptions

  add-onbugin:selenium
  zaproxy/zaproxy#9483 · Filter by author pediRAM opened on Sep 28, 2026
  2

• Filtering on alertRef is not working

  bug
  zaproxy/zaproxy#9476 · Filter by author alexkiro opened on Sep 22, 2026
  7

• Modern spider doesn't respect the specified time limit

  bug
  zaproxy/zaproxy#9471 · Filter by author alexkiro opened on Sep 18, 2026
  2

• Add support for HTTP/3

  add-onenhancementin:network
  zaproxy/zaproxy#9463 · Filter by author Nurmagoz opened on Sep 13, 2026
  3

• gRPC add-on fails to handle native application/grpc bodies because VariantGrpc assumes Base64

  add-onbugin:grpc
  zaproxy/zaproxy#9450 · Filter by author hideintheclouds opened on Sep 3, 2026
  5

  

• Session persistence fails with HSQLDB RowInputBinary / EOFException due to corrupt HISTORY index

  enhancement
  zaproxy/zaproxy#9445 · Filter by author daniel-ayers opened on Aug 31, 2026
  4

• Client Spider gives up on slow-booting SPAs: out-of-scope asset downloads do not count as page activity

  add-onin:client
  zaproxy/zaproxy#9440 · Filter by author guillermop2002 opened on Aug 26, 2026
  4

  

• SOAP add-on: SSRF + local-file access via wsdl:import/xsd:import (auto-triggered by WSDL spider)

  add-onin:soap
  zaproxy/zaproxy#9438 · Filter by author ibrahimaljaafreh opened on Aug 25, 2026
  

• [Site-tree] Add newly found subdomains and links as node to Sites without visiting the url.

  marketplace
  zaproxy/zaproxy#9426 · Filter by author ArkhaMahn opened on Aug 19, 2026
  5

• graphql: Imports may fail silently

  add-onbugComponent-UIin:graphqlUsability
  zaproxy/zaproxy#9407 · Filter by author kingthorin opened on Jul 24, 2026

• Unable to specify rules with dashes in OUTOFSCOPE/IGNORE rules

  Dockerenhancement
  zaproxy/zaproxy#9394 · Filter by author andrewj-nes opened on Jul 16, 2026
  3

• Login URL field not showing automatically in Authentication tester form

  add-onbugComponent-UIin:authhelperUsability
  zaproxy/zaproxy#9387 · Filter by author leolivier opened on Jul 12, 2026
  1

  

• Browsers launched by the Client Spider re-request the same static resources repeatedly

  zaproxy/zaproxy#9386 · Filter by author abidedavana opened on Jul 10, 2026
  4

• deleteAlerts and deleteAlert throw a NullPointerException when an alert has an invalid site node reference

  bug
  zaproxy/zaproxy#9383 · Filter by author Vitorrodrys opened on Jul 9, 2026
  1

• DeleteAlerts endpoint does not delete duplicate alerts

  bug
  zaproxy/zaproxy#9382 · Filter by author Vitorrodrys opened on Jul 9, 2026

• Add-on submission: Disclosure Contact Lookup (disclose/zap-lookup)

  marketplace
  zaproxy/zaproxy#9377 · Filter by author yesnet0 opened on Jul 7, 2026
  4

• Alert API and tree refresh load alerts from all sessions instead of current session

  Type-Task
  zaproxy/zaproxy#9346 · Filter by author tejgokani opened on May 28, 2026
  3

• Upgrade the version of commons-configuration

  Type-Task
  zaproxy/zaproxy#9344 · Filter by author mattloveparasoft opened on May 26, 2026
  3

• Outdated ZAP in Linux distros

  third-party
  zaproxy/zaproxy#9320 · Filter by author aoand opened on Apr 30, 2026
  16

• Crimson Blazor Decoder

  marketplace
  zaproxy/zaproxy#9311 · Filter by author crimsonwall opened on Apr 24, 2026
  4

  

• debian bookworm EOL 10 June 2026

  DockerType-Task
  zaproxy/zaproxy#9310 · Filter by author DWS-guy opened on Apr 24, 2026 · 2.18.0
  5

• Passive/active script rules might lose their metadata

  add-onbugin:scripts
  zaproxy/zaproxy#9297 · Filter by author samrachnouv opened on Apr 14, 2026
  2