Vulnerabilities
Summary — last 7 days
New vulnerabilities2,855▼ 333 vs. last week
Critical / high1,381▼ 36 vs. last week
New active exploitation (KEV)4▼ 5 vs. last week
Unscored (no CVSS)296▼ 213 vs. last week
6 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (7.1) | 0.24% | — | Http Requests ManagerAI | 10/6/2026 | 10/6/2026 | Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions. | |
| Deferred | Medium (5.4) | 0.33% | — | Pear Http Request2AI | 4/17/2025 | 6/17/2026 | In PEAR HTTP_Request2 before 2.7.0, multiple files in the tests directory, notably tests/_network/getparameters.php and tests/_network/postparameters.php, reflect any GET or POST parameters, leading to XSS. | |
| Modified | Medium (6.1) | 0.70% | — | Facetwp LOG Http Requests | 10/28/2022 | 6/17/2026 | The Log HTTP Requests plugin for WordPress is vulnerable to Stored Cross-Site Scripting via logged HTTP requests in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers who can trick a site's administrator into performing… | |
| Modified | Medium (6.5) | 0.84% | — | Jenkins Http Request | 7/27/2022 | 6/17/2026 | Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. | |
| Modified | High (7.4) | 0.91% | — | Em-http-request Project Em-http-requestFedoraproject Fedora | 5/25/2020 | 6/17/2026 | EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified. | |
| Modified | Medium (5.9) | 0.57% | — | Http Request Project Http Request | 7/23/2019 | 6/17/2026 | OSS Http Request (Apache Cordova Plugin) 6 is affected by: Missing SSL certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing. |