hoppscotch

Products

Exploited and recent CVEs

• CVE-2026-69189 High 7.6 Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers 0.4%
• CVE-2026-59720 High 7.5 Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server 0.6%
• CVE-2026-59721 High 7.2 Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection 1.0%
• CVE-2026-50160 Critical 10.0 Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite 1.7%
• CVE-2026-44478 High 7.5 hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token 0.2%
• CVE-2026-34931 High 8.5 hoppscotch: Improper loopback redirect_uri validation in device-login flow 0.4%
• CVE-2026-34848 Medium 5.4 hoppscotch: Stored XSS in team member overflow tooltip via display name 0.1%
• CVE-2026-34932 High 8.5 hoppscotch: Stored XSS via mock server responses on backend origin 0.3%
• CVE-2026-34847 Medium 4.7 hoppscotch: Open redirect via `/enter?redirect=` 0.4%
• CVE-2026-30825 None 0.0 hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token 0.3%
• CVE-2026-28217 Medium 6.5 IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections 0.4%
• CVE-2026-28216 High 8.3 hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment 0.4%
• CVE-2026-28215 Critical 9.1 hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover 0.6%
• CVE-2024-34714 High 7.6 Hoppscotch Extension responds to calls made by origins not in the domain list 0.3%
• CVE-2024-34347 High 8.4 @hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE 0.6%
• CVE-2024-27092 Medium 5.4 Content spoofing - real Hoppscotch emails 0.6%
• CVE-2023-34097 High 7.8 Database password exposed in logs in hoppscotch 0.7%
• CVE-2022-0121 High 8.0 Cross-site Scripting in hoppscotch/hoppscotch 1.2%