Login Request a demo
HO
Product
hoppscotch
by hoppscotch · last CVE Aug 18, 2026
17
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities17In the news0Timeline
Severity mix
Critical 4High 8Medium 5Low 0
Severity
All severities17Critical4High8Medium5Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add hoppscotch to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-34097
8.8
1%
Jun 5
Database password exposed in logs in hoppscotch
Affected: < 2023.4.5
CVE-2026-28216
8.3
0%
Feb 26
hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment
Affected: < 2026.2.0
CVE-2024-34347
8.3
1%
May 8
@hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE
Affected: >= 0.5.0, < 0.8.0
CVE-2022-0121
8.0
1%
Jan 6
Cross-site Scripting in hoppscotch/hoppscotch
Affected: through 2.1.0
CVE-2026-69189
7.6
0%
Aug 18
Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers
Affected: < 2026.6.0
CVE-2026-59720
7.5
1%
Jul 9
Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server
Affected: < 2026.6.0
CVE-2026-44478
7.5
0%
May 13
hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token
Affected: >= 2025.7.0, < 2026.4.0
CVE-2026-59721
7.2
1%
Jul 9
Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection
Affected: < 2026.6.0
Showing 8