Hoppscotch
Vulnerability activity for Hoppscotch: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 9
- Critical (CVSS 9+)
- 4
- Exploited (CISA KEV)
- 0
- With exploit code
- 2
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 10.0CriticalJul 1, 2026hoppscotchCVE-2026-50160Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The global NestJS ValidationPipe is configured without whitelist: true, so extra properties on the request body that are not declared in SaveOnboardingConfigRequest are not stripped and are iterated in the service layer as if they were legitimate InfraConfig entries. Because keys sNucleiDetection
- 9.3CriticalApr 2, 2026hoppscotch XSSCVE-2026-34932hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability that can lead to CSRF. This issue has been patched in version 2026.3.0.
- 9.6CriticalApr 2, 2026hoppscotchCVE-2026-34931hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account. This issue has been patched in version 2026.3.0.
- 5.4MediumApr 2, 2026hoppscotch XSSCVE-2026-34848hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability in the team member overflow tooltip via display name. This issue has been patched in version 2026.3.0.
- 4.7MediumApr 2, 2026hoppscotchCVE-2026-34847hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, the /enter page contains a DOM-based open redirect vulnerability. The redirect query parameter is directly used to construct a URL and redirect the user without proper validation. This issue has been patched in version 2026.3.0.NucleiDetection
- 0.0NoneMar 7, 2026hoppscotch Auth bypass / access controlCVE-2026-30825hoppscotch is an open source API development ecosystem. Prior to version 2026.2.1, the DELETE /v1/access-tokens/revoke endpoint allows any authenticated user to delete any other user's PAT by providing its ID, with no ownership verification. This issue has been patched in version 2026.2.1.
- 6.5MediumFeb 26, 2026hoppscotch Auth bypass / access controlCVE-2026-28217hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the `userCollection` GraphQL query accepts an arbitrary collection ID and returns the full collection data — including title, type, and the serialized `data` field containing HTTP requests with headers and potentially secrets — to any authenticated user, without verifying that the requesting user owns the collection. This is an Insecure Direct Object Reference (IDOR) caused by a missing authorization check that ex
- 8.3HighFeb 26, 2026hoppscotch Auth bypass / access controlCVE-2026-28216hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, any logged-in user can read, modify or delete another user's personal environment by ID. `user-environments.resolver.ts:82-109`, `updateUserEnvironment` mutation uses `@UseGuards(GqlAuthGuard)` but is missing the `@GqlUser()` decorator entirely. The user's identity is never extracted, so the service receives only the environment ID and performs a `prisma.userEnvironment.update({ where: { id } })` without any owner
- 9.1CriticalFeb 26, 2026hoppscotch Auth bypass / access controlCVE-2026-28215hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructure configuration of a self-hosted Hoppscotch instance including OAuth provider credentials and SMTP settings by sending a single HTTP POST request with no authentication. The endpoint POST /v1/onboarding/config has no authentication guard and performs no check on whether onboarding was already completed. A successful exploit allows the attacker to r
Top products
- hoppscotch9 CVEs in the last year, 4 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.