What’s Vulnerable › Products

hoppscotch vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Check whether your hoppscotch version is affected

Latest hoppscotch vulnerabilities

• CVE-2026-69189 — Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers (CVSS 7.6)
• CVE-2026-59721 — Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection (CVSS 7.2)
• CVE-2026-59720 — Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server (CVSS 7.5)
• CVE-2026-50160 — Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite (CVSS 10.0)
• CVE-2026-44478 — hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token (CVSS 7.5)
• CVE-2026-34932 — hoppscotch: Stored XSS via mock server responses on backend origin (CVSS 9.3)
• CVE-2026-34931 — hoppscotch: Improper loopback redirect_uri validation in device-login flow (CVSS 9.6)
• CVE-2026-34848 — hoppscotch: Stored XSS in team member overflow tooltip via display name (CVSS 5.4)
• CVE-2026-34847 — hoppscotch: Open redirect via `/enter?redirect=` (CVSS 6.1)
• CVE-2026-30825 — hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token (CVSS 6.5)
• CVE-2026-28217 — IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections (CVSS 6.5)
• CVE-2026-28216 — hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment (CVSS 8.3)
• CVE-2026-28215 — hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover (CVSS 9.1)
• CVE-2024-34347 — @hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE (CVSS 8.3)
• CVE-2024-27092 — Content spoofing - real Hoppscotch emails (CVSS 5.4)
• CVE-2023-34097 — Database password exposed in logs in hoppscotch (CVSS 8.8)
• CVE-2022-0121 — Cross-site Scripting in hoppscotch/hoppscotch (CVSS 8.0)