Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite

hoppscotch: Improper loopback redirect_uri validation in device-login flow

hoppscotch: Stored XSS via mock server responses on backend origin

hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover

Database password exposed in logs in hoppscotch

hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment

@hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE

Cross-site Scripting in hoppscotch/hoppscotch

Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers

Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server

hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token

Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection

hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token

IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections

hoppscotch: Open redirect via `/enter?redirect=`

hoppscotch: Stored XSS in team member overflow tooltip via display name

Content spoofing - real Hoppscotch emails