CWE-1428Base

Reliance on HTTP instead of HTTPS

Incomplete in the CWE catalog · 2 CVEs mapped

2
CVEs mapped
7.3
Median CVSS
What it is

The product provides or relies on use of HTTP communications when HTTPS is available.

Recent examples
7.0cvss
CVE-2026-10763

PROMOD V is using insecure HTTP communication instead of HTTPS

PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support from 3rd party Digipede server.

HIGHno explanation yet
0%
epss
7.7cvss
CVE-2026-40677

The use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a man-in-the-middle attack, potentially leading to arbitrary…

The use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a man-in-the-middle attack, potentially leading to arbitrary code execution.

HIGHno explanation yet
0%
epss
The record
Technical detail
CWE ID
CWE-1428
Abstraction
Base
Structure
Simple
Status
Incomplete
References (9)
https://aws.amazon.com/compare/the-difference-between-https-and-http/https://www.cloudflare.com/learning/ssl/why-is-http-not-secure/https://medium.com/@boblord/every-pipe-every-byte-the-case-for-universal-encryption-b8e08939d2b9https://www.eff.org/encrypt-the-web/https://github.com/OWASP/ASVS/blob/v4.0.3/4.0/OWASP%20Application%20Security%20Verification%20Standard%204.0.3-en.pdfhttps://github.com/OWASP/ASVS/blob/v4.0.3/4.0/OWASP%20Application%20Security%20Verification%20Standard%204.0.3-en.pdfhttps://github.com/OWASP/ASVS/blob/v4.0.3/4.0/OWASP%20Application%20Security%20Verification%20Standard%204.0.3-en.pdfhttps://web.dev/articles/fixing-mixed-contenthttps://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content