Hoppscotch vulnerabilities

Products

• Hoppscotch 17

Newest

• hoppscotch Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers CVE-2026-69189 7.6 HighAugust 18, 2026
• hoppscotch Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server CVE-2026-59720 7.5 HighJuly 9, 2026
• hoppscotch Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection CVE-2026-59721 7.2 HighJuly 9, 2026
• hoppscotch Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite CVE-2026-50160 10.0 CriticalJuly 1, 2026
• hoppscotch hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token CVE-2026-44478 7.5 HighMay 13, 2026
• hoppscotch hoppscotch: Improper loopback redirect_uri validation in device-login flow CVE-2026-34931 8.5 HighApril 2, 2026
• hoppscotch hoppscotch: Stored XSS in team member overflow tooltip via display name CVE-2026-34848 5.4 MediumApril 2, 2026
• hoppscotch hoppscotch: Stored XSS via mock server responses on backend origin CVE-2026-34932 8.5 HighApril 2, 2026
• hoppscotch hoppscotch: Open redirect via `/enter?redirect=` CVE-2026-34847 4.7 MediumApril 2, 2026
• hoppscotch hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token CVE-2026-30825 0.0 NoneMarch 7, 2026
• hoppscotch IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections CVE-2026-28217 6.5 MediumFebruary 26, 2026
• hoppscotch hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment CVE-2026-28216 8.3 HighFebruary 26, 2026
• hoppscotch hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover CVE-2026-28215 9.1 CriticalFebruary 26, 2026
• hoppscotch extension, hoppscotch-extension +1 more Hoppscotch Extension responds to calls made by origins not in the domain list CVE-2024-34714 7.6 HighMay 14, 2024
• hoppscotch @hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE CVE-2024-34347 Fix available 8.4 HighApril 22, 2024
• hoppscotch Content spoofing - real Hoppscotch emails CVE-2024-27092 5.4 MediumFebruary 26, 2024
• hoppscotch Database password exposed in logs in hoppscotch CVE-2023-34097 7.8 HighJune 5, 2023
• hoppscotch, hoppscotch hoppscotch/hoppscotch +1 more Cross-site Scripting in hoppscotch/hoppscotch CVE-2022-0121 8.0 HighJanuary 6, 2022