Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache HertzBeat

7 known vulnerabilities.

Apache HertzBeat at a glance

Last 12 months
2
Critical · all time
0
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 1 vulnerability March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 1 vulnerability
Show as table
MonthVulnerabilitiesCritical
Nov 202610
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202610
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202510
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium 6.5
    CVE-2026-114442

    Apache HertzBeat: incomplete XPath expression validation in aliasFields

    Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.…

    Apache Software Foundation Apache HertzBeat
  • High 8.8
    CVE-2026-24343

    Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions

    Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.

    Apache Software Foundation Apache HertzBeat
  • Medium 6.5
    CVE-2024-56736

    Apache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config Oss

    Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat (incubating): before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue.

    Apache Software Foundation Apache HertzBeat
  • High 8.8
    CVE-2024-41151

    Apache HertzBeat: RCE by notice template injection vulnerability

    Deserialization of Untrusted Data vulnerability in Apache HertzBeat. This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue.

    Apache Software Foundation Apache HertzBeat
  • High 7.5
    CVE-2024-45791

    Apache HertzBeat: Exposure sensitive token via http GET method with query string

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue.

    Apache Software Foundation Apache HertzBeat
  • High 8.8
    CVE-2024-45505

    Apache HertzBeat: Exists Native Deser RCE and file writing vulnerabilities

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat (incubating): before 1.6.…

    Apache Software Foundation Apache HertzBeat
  • High 8.8
    CVE-2024-42323 Public exploit

    Apache HertzBeat: RCE by snakeYaml deser load malicious xml

    SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating).  This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat (incubating): before 1.6.0. Users are recommended to upgrade to versi…

    Apache Software Foundation Apache HertzBeat