LoginSign Up
← Back to all sparks
G

Greenbone Vulnerability Manager

INFRA · APIS
Velocity6.3

Vulnerability scanning and management service behind the Greenbone security stack

www.greenbone.net ↗

Greenbone's scanner daemon is growing a web-application scanning class beside its network roots.

vulnerability managementweb application scanninggmp protocolreport modelingmemory safety
◆Current state
gvmd releases every week or two, and the changelog splits cleanly in three: a sustained build-out of web application scanning, a rewrite of how reports are modeled and exported, and a long tail of memory-management fixes in the C core. Recent versions added web application scanner preferences, scanner verification, and a Web Application VT subtype with a database migration. The report work moved from ad-hoc XML toward a structured report model addressable through new GMP commands.
◆Where it's heading
Greenbone is widening what gvmd can orchestrate. Network and container scanning were the existing surface; web application scanning is being brought to parity, with its own VT class, preferences, validation, and verification path. In parallel the GMP protocol is gaining first-class report retrieval commands, which makes report data consumable by tooling rather than only renderable. The bug-fix stream is dominated by frees and cleanup in long-lived report paths, the signature of a codebase under memory pressure at scale.
◆Prediction
Web Application VTs now have a subtype, a migration, and scanner verification, but the audit and scan report commands were added separately; expect the report model work to fold web application results into the same structured retrieval path rather than leaving a parallel one.

◆Recent moves

  1. 5d ago

    openvasd library bumped to 23.9

    A single dependency bump of the openvasd library from 23.3 to 23.9, tagged on its own. No user-facing change.

    View source ↗
  2. 5d ago

    GMP gains a get_audit_report_hosts command

    Adds a get_audit_report_hosts command to GMP with documentation, renames the report exports table, and closes a leak of audit report host keys. It continues the pattern of making report data addressable through the protocol rather than only through the UI.

    View source ↗
  3. 10d ago

    Web Application VTs become a first-class scan type

    ⚡ SPARK

    The release where web application scanning stops being a scanner setting and becomes part of the data model, with ZAP VTs renamed to Web Application VTs, a migration, and a new GMP subtype. The scanner preferences in 26.32.0 and the verification work in 26.33.0 were the run-up to this.

    View source ↗
  4. 18d ago

    Structured report model and the get_scan_report command

    Introduces structured report model loading with progress information and a GMP get_report command, promptly renamed to get_scan_report to make room for the audit variant. Early scaffolding for the report retrieval work that lands in later versions.

    View source ↗
  5. 19d ago

    Per-object asset permissions and report-script trust checks

    Adds per-object permission checks for modifying and deleting assets and tightens trust validation before executing report format scripts, alongside several memory frees. Security hardening of the management layer rather than of what it scans.

    View source ↗
  6. 24d ago

    Aggregate grouping and family-name fixes

    Two narrow fixes: requiring a group column when a subgroup is given in GET_AGGREGATES, and a missing comma in a family name. A patch tag with no behavior change of consequence.

    View source ↗