hoppscotch vulnerabilities
18 published CVEs name hoppscotch among the affected products.
- 18Published CVEs17 of them scored
- 13Last 12 monthspublished in the last year
- 2Critical11 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-69189
Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers
hoppscotch · hoppscotch
High7.6 - CVE-2026-59720
Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server
hoppscotch · hoppscotch
High7.5 - CVE-2026-59721
Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection
hoppscotch · hoppscotch
High7.2 - CVE-2026-50160
Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite
hoppscotch · hoppscotch
Critical10.0 - CVE-2026-44478
hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token
hoppscotch · hoppscotch
High7.5 - CVE-2026-34931
hoppscotch: Improper loopback redirect_uri validation in device-login flow
hoppscotch · hoppscotch
High8.5 - CVE-2026-34848
hoppscotch: Stored XSS in team member overflow tooltip via display name
hoppscotch · hoppscotch
Medium5.4 - CVE-2026-34932
hoppscotch: Stored XSS via mock server responses on backend origin
hoppscotch · hoppscotch
High8.5 - CVE-2026-34847
hoppscotch: Open redirect via `/enter?redirect=`
hoppscotch · hoppscotch
Medium4.7 - CVE-2026-30825
hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token
hoppscotch · hoppscotch
None0.0