Yes, Invicti can find both known and new vulnerabilities in web applications. The core security scanner comes with hundreds of security checks to identify exploitable weaknesses by safely simulating attacks and analyzing app reactions. This is accompanied by a vulnerability database of products with known vulnerabilities (CVEs) that are also reported when identified during a scan.
Read more on how Invicti finds vulnerabilities