Skip to content
OpenAdvisories

Vendor

hoppscotch

18 known vulnerabilities.

Products

hoppscotch 16 hoppscotch-extension 1 hoppscotch/hoppscotch 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-34848

    hoppscotch: Stored XSS in team member overflow tooltip via display name

    hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability in the team member overflow tooltip via display name. This issue has been patched in version 2026.3.0.

    hoppscotch hoppscotch
  • Medium 4.7
    CVE-2026-34847 Scanner template

    hoppscotch: Open redirect via `/enter?redirect=`

    hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, the /enter page contains a DOM-based open redirect vulnerability. The redirect query parameter is directly used to construct a URL and redirect the user without proper validati…

    hoppscotch hoppscotch
  • Medium 6.5
    CVE-2026-28217

    IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections

    hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the `userCollection` GraphQL query accepts an arbitrary collection ID and returns the full collection data — including title, type, and the serialized `data` field containing H…

    hoppscotch hoppscotch
  • Medium 5.4
    CVE-2024-27092

    Content spoofing - real Hoppscotch emails

    Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label (Edit Team) - TeamName, bad actors can send emails with Spoofed Content as Hoppscotch. Part of payload (external link) is presented in clickable form - easier to achie…

    hoppscotch hoppscotch