HO
Vendor
hoppscotch
19
CVEs
0
On KEV
0
New 30D
Products
HO10.0
hoppscotch
hoppscotch
17 CVEs0 on KEV0 new
HO7.6
hoppscotch-extension
hoppscotch
1 CVEs0 on KEV0 new
HO8.0
hoppscotch/hoppscotch
hoppscotch
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-69189 | HO hoppscotch hoppscotch | 7.6 | Aug 18 | Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers |
| CVE-2026-59720 | HO hoppscotch hoppscotch | 7.5 | Jul 9 | Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server |
| CVE-2026-59721 | HO hoppscotch hoppscotch | 7.2 | Jul 9 | Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection |
| CVE-2026-50160 | HO hoppscotch hoppscotch | 10.0 | Jul 1 | Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite |
| CVE-2026-44478 | HO hoppscotch hoppscotch | 7.5 | May 13 | hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token |
| CVE-2026-34931 | HO hoppscotch hoppscotch | 9.6 | Apr 2 | hoppscotch: Improper loopback redirect_uri validation in device-login flow |
| CVE-2026-34848 | HO hoppscotch hoppscotch | 5.4 | Apr 2 | hoppscotch: Stored XSS in team member overflow tooltip via display name |
| CVE-2026-34932 | HO hoppscotch hoppscotch | 9.3 | Apr 2 | hoppscotch: Stored XSS via mock server responses on backend origin |
| CVE-2026-34847 | HO hoppscotch hoppscotch | 6.1 | Apr 2 | hoppscotch: Open redirect via `/enter?redirect=` |
| CVE-2026-30825 | HO hoppscotch hoppscotch | 6.5 | Mar 7 | hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token |
| CVE-2026-28217 | HO hoppscotch hoppscotch | 6.5 | Feb 26 | IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections |
| CVE-2026-28216 | HO hoppscotch hoppscotch | 8.3 | Feb 26 | hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment |
| CVE-2026-28215 | HO hoppscotch hoppscotch | 9.1 | Feb 26 | hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover |
| CVE-2024-34714 | HO hoppscotch-extension hoppscotch | 7.6 | May 14 | Hoppscotch Extension responds to calls made by origins not in the domain list |
| CVE-2024-34347 | HO hoppscotch hoppscotch | 8.3 | May 8 | @hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE |
| CVE-2024-27092 | HO hoppscotch hoppscotch | 5.4 | Feb 26 | Content spoofing - real Hoppscotch emails |
| CVE-2023-34097 | HO hoppscotch hoppscotch | 8.8 | Jun 5 | Database password exposed in logs in hoppscotch |
| CVE-2022-0121 | HO hoppscotch/hoppscotch hoppscotch | 8.0 | Jan 6 | Cross-site Scripting in hoppscotch/hoppscotch |