Vulnerabilities

TI-2026-48539 CVE-2026-69189

Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers

HIGH 66

Hoppscotch is an open source API development ecosystem.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00394 Published 2026-08-18 Fixed in 2026.6.0 CWE-200

TI-2026-42590 CVE-2026-59720

Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server

HIGH 72

Hoppscotch is an open source API development ecosystem.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00593 Published 2026-07-09 Fixed in 2026.6.0 CWE-200

TI-2026-42591 CVE-2026-59721

Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection

HIGH 67

Hoppscotch is an open source API development ecosystem.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01009 Published 2026-07-09 Fixed in 2026.6.0 CWE-77

TI-2026-36924 CVE-2026-50160

Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite

HIGH 82

Hoppscotch is an API development ecosystem.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01701 Published 2026-07-01 No fix listed CWE-915

TI-2026-32417 CVE-2026-44478

hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token

HIGH 72

hoppscotch is an open source API development ecosystem.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0024 Published 2026-05-13 Fixed in 2026.4.0 CWE-284

TI-2026-27155 CVE-2026-34931

hoppscotch: Improper loopback redirect_uri validation in device-login flow

HIGH 72

hoppscotch is an open source API development ecosystem.

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.0038 Published 2026-04-02 Fixed in 2026.3.0 CWE-601

TI-2026-27087 CVE-2026-34848

hoppscotch: Stored XSS in team member overflow tooltip via display name

LOW 23

hoppscotch is an open source API development ecosystem.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00147 Published 2026-04-02 Fixed in 2026.3.0 CWE-79

TI-2026-27156 CVE-2026-34932

hoppscotch: Stored XSS via mock server responses on backend origin

LOW 39

hoppscotch is an open source API development ecosystem.

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.00293 Published 2026-04-02 Fixed in 2026.3.0 CWE-79

TI-2026-27086 CVE-2026-34847

hoppscotch: Open redirect via `/enter?redirect=`

LOW 27

hoppscotch is an open source API development ecosystem.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00401 Published 2026-04-02 Fixed in 2026.3.0 CWE-601

TI-2026-23654 CVE-2026-30825

hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token

LOW 28

hoppscotch is an open source API development ecosystem.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00254 Published 2026-03-07 Fixed in 2026.2.1 CWE-639

TI-2026-22552 CVE-2026-28217

IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections

MEDIUM 62

hoppscotch is an open source API development ecosystem.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00415 Published 2026-02-26 Fixed in 2026.2.0 CWE-862

TI-2026-22551 CVE-2026-28216

hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment

HIGH 71

hoppscotch is an open source API development ecosystem.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00444 Published 2026-02-26 Fixed in 2026.2.0 CWE-639

TI-2026-22550 CVE-2026-28215

hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover

MEDIUM 48

hoppscotch is an open source API development ecosystem.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00588 Published 2026-02-26 Fixed in 2026.2.0 CWE-284

TI-2024-23011 CVE-2024-34714

Hoppscotch Extension responds to calls made by origins not in the domain list

LOW 33

The Hoppscotch Browser Extension is a browser extension for Hoppscotch, a community-driven end-to-end open-source API development ecosystem.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00326 Published 2024-05-14 Fixed in 0.35 CWE-354

TI-2024-22688 CVE-2024-34347 · GHSA-qmmm-73r2-f8xr

@hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE

HIGH 72

@hoppscotch/cli is a CLI to run Hoppscotch Test Scripts in CI environments.

CVSS 3.1HIGH 8.4 Network No auth User interaction EPSS 0.00616 Published 2024-05-08 Fixed in 0.8.0 CWE-77

TI-2024-17953 CVE-2024-27092

Content spoofing - real Hoppscotch emails

MEDIUM 58

Hoppscotch is an API development ecosystem.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00608 Published 2024-02-26 Fixed in 2023.12.6 CWE-20

TI-2023-16943 CVE-2023-34097

Database password exposed in logs in hoppscotch

HIGH 73

hoppscotch is an open source API development ecosystem.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0068 Published 2023-06-05 Fixed in 2023.4.5 CWE-532

TI-2022-00066 CVE-2022-0121 · GHSA-4rhc-g7g9-q5w5

Cross-site Scripting in hoppscotch/hoppscotch

LOW 37

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoppscotch hoppscotch/hoppscotch.This issue affects hoppscotch/hoppscotch before 2.1.1.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.01234 Published 2022-01-06 Fixed in 2.1.1 CWE-79

Vulnerabilities

Filters