hoppscotch

Records18All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high11CVSS 7.0–8.9

Exploited now

hoppscotch records in CISA KEV

No hoppscotch vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Hoppscotch 12 records HIGH

Records

12 records in Hoppscotch · all components

TI-2026-36924 CVE-2026-50160

Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite

HIGH 82

Hoppscotch is an API development ecosystem.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01701 Published 2026-07-01 No fix listed CWE-915

TI-2023-16943 CVE-2023-34097

Database password exposed in logs in hoppscotch

HIGH 73

hoppscotch is an open source API development ecosystem.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0068 Published 2023-06-05 Fixed in 2023.4.5 CWE-532

TI-2026-27155 CVE-2026-34931

hoppscotch: Improper loopback redirect_uri validation in device-login flow

HIGH 72

hoppscotch is an open source API development ecosystem.

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.0038 Published 2026-04-02 Fixed in 2026.3.0 CWE-601

TI-2026-22551 CVE-2026-28216

hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment

HIGH 71

hoppscotch is an open source API development ecosystem.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00444 Published 2026-02-26 Fixed in 2026.2.0 CWE-639

TI-2026-22552 CVE-2026-28217

IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections

MEDIUM 62

hoppscotch is an open source API development ecosystem.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00415 Published 2026-02-26 Fixed in 2026.2.0 CWE-862

TI-2024-17953 CVE-2024-27092

Content spoofing - real Hoppscotch emails

MEDIUM 58

Hoppscotch is an API development ecosystem.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00608 Published 2024-02-26 Fixed in 2023.12.6 CWE-20

TI-2026-22550 CVE-2026-28215

hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover

MEDIUM 48

hoppscotch is an open source API development ecosystem.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00588 Published 2026-02-26 Fixed in 2026.2.0 CWE-284

TI-2026-27156 CVE-2026-34932

hoppscotch: Stored XSS via mock server responses on backend origin

LOW 39

hoppscotch is an open source API development ecosystem.

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.00293 Published 2026-04-02 Fixed in 2026.3.0 CWE-79

TI-2022-00066 CVE-2022-0121 · GHSA-4rhc-g7g9-q5w5

Cross-site Scripting in hoppscotch/hoppscotch

LOW 37

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoppscotch hoppscotch/hoppscotch.This issue affects hoppscotch/hoppscotch before 2.1.1.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.01234 Published 2022-01-06 Fixed in 2.1.1 CWE-79

TI-2026-23654 CVE-2026-30825

hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token

LOW 28

hoppscotch is an open source API development ecosystem.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00254 Published 2026-03-07 Fixed in 2026.2.1 CWE-639

TI-2026-27086 CVE-2026-34847

hoppscotch: Open redirect via `/enter?redirect=`

LOW 27

hoppscotch is an open source API development ecosystem.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00401 Published 2026-04-02 Fixed in 2026.3.0 CWE-601

TI-2026-27087 CVE-2026-34848

hoppscotch: Stored XSS in team member overflow tooltip via display name

LOW 23

hoppscotch is an open source API development ecosystem.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00147 Published 2026-04-02 Fixed in 2026.3.0 CWE-79

Open these records in search →