May 2026

Release Notes: May 2026

:::info Explore What’s New from Cobalt This Month

:::

CVE Data Now Structured on Findings

Findings now support a dedicated CVE field, so testers can search and attach CVE identifiers directly from the finding detail view — filtering by CVE ID, software name, or vendor.

Structured CVE data also flows across the platform:

• Public API — CVE IDs are exposed as fields, queryable and documented in the schema.
• CSV exports — CVE IDs appear as dedicated columns in all standard finding exports.
• Integrations — CVE data is included by default in native Jira syncs. For other integrations, the CVE data pill is available to add to your recipes.

Bi-Directional Finding-Level Messaging via Public API

We are excited to announce the release of Public API routes and real-time webhooks for Finding-level comments, designed to bridge the communication gap between development teams, security professionals, and pentesters.

Previously, while Cobalt integrations could automatically create external tickets (like Jira) for pentest findings, teams still had to switch back over to the Cobalt platform to discuss remediation details with their testers. This context switching created unnecessary friction and communication silos.

With this update, you can fully eliminate those barriers. Our newly exposed public API endpoints grant full CRUD (Create, Read, Update, Delete) programmatic access to finding comments. Paired with our new webhook event subscriptions for comment activity, you can build a live, securely synchronized messaging feed directly inside your team's preferred toolkit.

Ready to streamline your remediation workflows? Explore our Findings API Developer Documentation today.