TotalAppSec Release 2.10 | Web Application Scanning Release 1.30

July ??, 2026

TotalAppSec and Web Application Scanning

Column Hiding for Data List Pages

You can now customize data list pages by showing or hiding columns using the Columns option. This enhancement allows you to customize the list view to your needs, making it easier to focus on the most relevant information while reducing visual clutter.

Click on the icon and select Columns. Select or clear the check boxes for individual columns to show or hide them on the page.

choose the required columns

Subdomain Validation Enhancements

We have enhanced the validation behavior for the Subdomain field in the Add New wizard. The field now validates subdomain entries based on the configured main URL, providing more accurate and predictable validation during web application setup. If the URL is an IPv4 or IPv6 address, the subdomain scope option is not applicable. Previously, the validation did not distinguish between domain- and IP address-based configurations, which could result in inconsistent behavior.

Navigate to Web Applications > New Web App > Add New. In the Crawl Settings, configure the Subdomain field.

Search Token Update

We have updated the QQL (Qualys Query Language) search tokens by renaming vulnerability tokens to finding tokens. For example, vulnerability.id is now finding.id.

Update any saved searches or QQL queries that reference the previous vulnerability token names.

search for tokens using finding

Optional Distribution Group

You can now create a report schedule without specifying a Distribution list and Additional recipients in the Notifications section. If no recipients are specified, notification emails are automatically sent to users who own or have access to the associated web application assets.

Detection Score Filter for Detection Groups

You can now filter detections using the Detection Score in the Detections. This enhancement enables you to organize detections based on their detection scores, making it easier to analyze and manage findings.

Enhanced User Interface

With this release, we have introduced an improved user experience across all TotalAppSec and Web Application Scanning pages. You can see updates across fonts, colors, typography, and buttons, making the interface more intuitive and easier to use. This release features User Interface and design system enhancements that improve visual consistency, readability, and usability across the application, resulting in a cleaner, more intuitive user experience.

In this release, we have enhanced the user experience on all TAS and WAS pages. You can notice updates to fonts, colors, typography, and buttons that make the interface more intuitive and user-friendly. This release features improvements to the User Interface and design system that enhance visual consistency, readability, and usability throughout the application, resulting in a cleaner and more intuitive User experience.

Key benefits are:

Cleaner, more consistent screens
Easier-to-read and understandable text
Important information stands out better, with less clutter
Faster comprehension of risk, status, and numbers

User Interface Consistency and Clarity

Introducing the new and improved User Interface with the following key upgrades:

Easier-to-read labels and text, with ALL CAPS replaced by sentence-style text
Consistent text style for status and source names across the application
Uniform text colors in tables, filters, page numbers, and tabs
Aligned colors and text styles for tabs and page navigation throughout the application
Clear visual indicators for buttons and options, showing active, inactive, or secondary states
Better emphasis on important information, with subtle styling for less critical details to help users focus

Charts, Metrics, and Data Presentation

You can view the following updates:

Updated chart color schemes for improved clarity and accessibility
Compact, more readable numeric formats for better visibility
Refined color gradients for risk scores and meters to enhance interpretation

New user interface

Asset Action Renaming

The following asset actions have been renamed for Web Application and API assets to improve consistency across the platform:

Purge is now Clear App Data, which removes only scans and detections while retaining the asset.
Remove/Delete is now Purge (Remove Web Application/API Asset), which removes the asset from the subscription.

These changes clearly distinguish between clearing an asset's data and removing the asset from the subscription.

Issues Addressed

The following reported issues are fixed in this release.

Application	Component	Description
TAS and WAS	Online Reports	Resolved an issue where the Edit button appeared disabled for API-generated Online Reports after the QSS Reports migration.
TAS and WAS	Scan Launch and Processing Flow	Resolved an issue where scheduled WAS scans failed to launch with the error More than one row with the given identifier was found. Also, introducing query-level handling to prevent duplicate records, and enforcing database uniqueness for Scan IDs.
TAS and WAS	Detection & Web Application Search	Resolved an issue where searches using the finding.url QQL token failed and returned an error when the URL contained SQL injection payload patterns. Users can now search detections and web applications using finding.url, including URLs containing vulnerability payloads, and records are retrieved correctly.
TAS and WAS	Adding Web Application	Resolved an issue where users were unable to create a Web Application in the WAS module when a Potential Web Application with the same name already existed in the EASM module. Users can now successfully create and save a WAS Web Application using the same name as an EASM Potential Web Application, while duplicate names across WAS-managed assets continue to be prevented.
TAS and WAS	Scan Status Display for Non-QSS Schedules	The scan status handling has been corrected so that completed scans continue to display their proper status and are no longer incorrectly marked as Error when overlapping schedule conditions occur.
TAS and WAS	API Scan Reporting	Resolved an issue where certain API vulnerability findings displayed NA for the Response section in API Scan Reports even though valid request and response data was available in the scan results.
TAS and WAS	TruRisk Score	Resolved an issue where TruRisk scores were not displayed in the datalist. TruRisk scores are now displayed correctly and consistently for affected web applications.
TAS and WAS	TAS Scheduled Reports Visibility	Investigated an issue where users with access to a Parent Tag could view web applications associated with Child Tags but were unable to see TAS Scheduled Reports associated with those same Child Tags.
TAS and WAS	Vulnerability Closure on Non-Found URL	Resolved an issue with the Close Vulnerabilities on Non Found URL feature where findings closed due to a missing vulnerable URL were recorded with an incorrect status message. The status handling has been corrected so that findings closed because the vulnerable URL cannot be located are now recorded using the appropriate status NOT_TESTED: Vulnerable URL cannot be found anymore, accurately reflecting the scan outcome.
TAS and WAS	Tag Permissions	Resolved an issue where users without Tag management permissions could still view and modify Tags within Authentication Records when assigned editor permissions. Tag access validation is now applied consistently across Authentication Records and Web Applications, ensuring that only users with the appropriate Tag permissions can view, assign, or modify Tags.
TAS and WAS	API Authentication	Resolved an issue where API Authentication Records did not provide a None authentication type option. A new None option has been added to the Authentication Type selection.
TAS and WAS	V3 Schedule Scan API Response Format	Resolved an issue introduced after QSS migration where the tagList field returned by the WAS API v3 Schedule Details response changed from a list structure to a set structure. The API response format has been reviewed and aligned with the expected behavior, and the corresponding documentation has been updated to prevent integration discrepancies.
TAS and WAS	Ignored Findings Reason and Comment Synchronization	Resolved an issue where findings that were globally ignored from the Knowledge Base were correctly marked as Ignored in the Detections module, but the Reason and Comment entered during the ignore action were not displayed in Detection Details > Additional Information.
TAS and WAS	Scheduled Scan Launch After QSS Migration	Resolved an issue where scheduled scans stopped launching after QSS migration and failed with the message There is already a scan with this title in your subscription. The issue occurred when schedules that exceeded the new QSS run-count limit were deactivated and later reactivated.
TAS and WAS	Scheduled Scan Proxy Validation	The validation logic has been updated to allow proxies that are either associated with the Web Application or configured as global proxies. Users can now successfully create and modify schedules using global proxies.
TAS and WAS	Scheduled Scan Launch Reliability	Resolved an issue where scheduled scans were not triggered as scheduled and eventually became permanently skipped after database connection timeouts occurred during schedule processing.
TAS and WAS	Database Timeout Handling	Resolved an issue where scheduled scans were not triggered as expected and were eventually skipped after database timeout errors occurred during schedule execution. Scheduled scans now launch reliably and complete schedule-processing operations correctly.
TAS and WAS	Scan Status Display for QSS Schedules	Resolved an issue where long-running progressive or scheduled scans were incorrectly displayed as Error in the user interface even though scan execution completed successfully and valid results were generated.
TAS and WAS	Scan Launch via Scanner Pool	The scan launch process has been optimized, reducing the time required to determine scanner availability and initiate scans. Scan launches now complete more efficiently and consistently.
TAS and WAS	Active Scan Schedules	Resolved an issue where active and valid scan schedules were incorrectly displayed under the Invalid quick filter and returned by the QQL search token for invalid schedules. The validation logic has been corrected so that schedules are classified accurately.

Last updated: August, 2026