Go package intelligence
github.com/SpectoLabs/hoverfly Known Exploited Vulnerabilities
Track evidence-backed exploitation affecting the Go package github.com/SpectoLabs/hoverfly, including the gap beyond CISA KEV, confidence assessments, and sensor observations.
- Total KEVs
- 2
- Known exploited vulnerabilities affecting github.com/SpectoLabs/hoverfly
- In CISA KEV
- 0
- Records also listed in the official catalog
- Beyond CISA KEV
- 2
- Additional exploited vulnerabilities absent from CISA KEV
- Sensor Observed
- 0
- github.com/SpectoLabs/hoverfly KEVs with sensor-observed exploitation activity
Review github.com/SpectoLabs/hoverfly exploitation against the versions you run
Two of the two exploited github.com/SpectoLabs/hoverfly vulnerabilities tracked here are not in CISA KEV.
- 0%
- Covered by CISA
- 100%
- Beyond CISA
Attested github.com/SpectoLabs/hoverfly vulnerabilities
2 known exploited vulnerabilities affecting this package.
| Vulnerability | CISA KEV | Added |
|---|---|---|
|
CVE-2024-45388
Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`) |
Beyond CISA | 14 Feb 2026 |
|
CVE-2025-54123
Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation |
Beyond CISA | 11 Nov 2025 |
Recurring weakness patterns
Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') account for mapped occurrences across this github.com/SpectoLabs/hoverfly KEV portfolio.