hoppscotch vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20231
3. 20243
4. 202613

Newest CVEs

• CVE-2026-69189

  Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers

  hoppscotch · hoppscotch

  High7.6
• CVE-2026-59720

  Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server

  hoppscotch · hoppscotch

  High7.5
• CVE-2026-59721

  Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection

  hoppscotch · hoppscotch

  High7.2
• CVE-2026-50160

  Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite

  hoppscotch · hoppscotch

  Critical10.0
• CVE-2026-44478

  hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token

  hoppscotch · hoppscotch

  High7.5
• CVE-2026-34931

  hoppscotch: Improper loopback redirect_uri validation in device-login flow

  hoppscotch · hoppscotch

  High8.5
• CVE-2026-34848

  hoppscotch: Stored XSS in team member overflow tooltip via display name

  hoppscotch · hoppscotch

  Medium5.4
• CVE-2026-34932

  hoppscotch: Stored XSS via mock server responses on backend origin

  hoppscotch · hoppscotch

  High8.5
• CVE-2026-34847

  hoppscotch: Open redirect via `/enter?redirect=`

  hoppscotch · hoppscotch

  Medium4.7
• CVE-2026-30825

  hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token

  hoppscotch · hoppscotch

  None0.0