How many Apache Software Foundation hertzbeat CVEs are in CISA KEV?

None of Apache Software Foundation hertzbeat's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of Apache Software Foundation hertzbeat are affected?

28 distinct Apache Software Foundation hertzbeat versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Apache Software Foundation hertzbeat CVEs?

Apache Software Foundation hertzbeat's CVEs most often map to these CWE weakness types: CWE-502 (Deserialization of Untrusted Data), CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), CWE-643 (Improper Neutralization of Data within XPath Expressions ('XPath Injection')), CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')).

What is the average severity of Apache Software Foundation hertzbeat CVEs?

The average CVSS base score across Apache Software Foundation hertzbeat's scored CVEs is 8.7.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Apache Software Foundation

16 CVEs

Apache Software Foundation hertzbeat Vulnerabilities

Name: Apache Software Foundation hertzbeat vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for hertzbeat by Apache Software Foundation.

16

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

5

Public exploits

PoC or exploit code

8.7

Avg CVSS

2023–2026

Last updated February 10, 2026

Overview

Apache Software Foundation hertzbeat has 16 published CVE records since 2023, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 5 have a known public exploit. The average CVSS base score across scored CVEs is 8.7.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Apache Software Foundation hertzbeat, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Apache Software Foundation hertzbeat's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical4

High11

Medium1

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Apache Software Foundation hertzbeat's CVEs are currently listed in CISA's KEV catalog.

Public exploits

5

5 of Apache Software Foundation hertzbeat's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Apache Software Foundation hertzbeat version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

1.6.06 CVEs
1.7.01 CVE
1.7.2-rc11 CVE

Version ranges

< 1.4.15 CVEs
< 1.6.03 CVEs
< 1.6.13 CVEs
< 1.7.02 CVEs
< 1.2.11 CVE
< 1.7.31 CVE
<= 1.6.01 CVE
1.7.1 <= v < 1.8.01 CVE

Fixed in

1.4.15 CVEs
1.6.03 CVEs
1.6.13 CVEs
708b5a2b1b4a3955fb8a3790cec0654259bbd5da3 CVEs
e27845273b1f4b45109bf4b59c3848148128fd1d3 CVEs
1.7.02 CVEs
8dcf050e27ca95d15460a7ba98a3df8a9cd1d3d22 CVEs
b77222765c06e895e61c972dfdf8df38c66e66102 CVEs
> 1.6.01 CVE
1.2.11 CVE
1.7.31 CVE
1.8.01 CVE
1b51c19c972cdccd2970b71e72ed73dad8ff92a91 CVE

Find a version

16 CVEs

Sort

Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions
CVE-2026-24343
Patch
CWE-643
High · CVSS 8.8
EPSS 0.7% (49th pct)2026-02-10
Apache HertzBeat (incubating): Jmx JNDI injection vulnerability
CVE-2025-48208
Patch
CWE-90
High · CVSS 8.8
EPSS 0.6% (44th pct)2025-09-09
Apache HertzBeat (incubating): RCE by parse http sitemap xml response
CVE-2025-24404
Patch
CWE-91
High · CVSS 8.8
EPSS 0.5% (38th pct)2025-09-09
Medium vulnerability · 2025-04-16
CVE-2024-56736
Patch
CWE-918
Medium · CVSS 6.5
EPSS 0.6% (43th pct)2025-04-16
High vulnerability · 2024-11-18
CVE-2024-41151
Patch
CWE-502
High · CVSS 8.8
EPSS 1.0% (57th pct)2024-11-18
High vulnerability · 2024-11-18
CVE-2024-45791
Patch
CWE-200
High · CVSS 7.5
EPSS 0.8% (52th pct)2024-11-18
Apache HertzBeat: Exists Native Deser RCE and file writing vulnerabilities
CVE-2024-45505
Patch
CWE-77
High · CVSS 8.8
EPSS 2.1% (80th pct)2024-11-18
High vulnerability · 2024-09-21
CVE-2024-42323
Patch
CWE-502
High · CVSS 8.8
EPSS 4.1% (89th pct)2024-09-21
High vulnerability · 2024-08-20
CVE-2024-42362
Public exploit
Patch
CWE-502
High · CVSS 8.8
EPSS 1.3% (68th pct)2024-08-20
GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}
CVE-2024-42361
Public exploit
Patch
CWE-89
Critical · CVSS 9.8
EPSS 1.1% (61th pct)2024-08-20
Critical vulnerability · 2024-02-22
CVE-2023-51389
Public exploit
Patch
CWE-502
Critical · CVSS 9.8
EPSS 1.3% (67th pct)2024-02-22
HertzBeat AviatorScript Inject RCE
CVE-2023-51388
Public exploit
Patch
CWE-74
Critical · CVSS 9.8
EPSS 1.3% (67th pct)2024-02-22
Critical vulnerability · 2024-02-22
CVE-2023-51653
Patch
CWE-74
Critical · CVSS 9.8
EPSS 2.1% (80th pct)2024-02-22
High vulnerability · 2023-12-22
CVE-2023-51650
Public exploit
Patch
CWE-862
High · CVSS 7.5
EPSS 0.9% (54th pct)2023-12-22
High vulnerability · 2023-12-22
CVE-2023-51387
Patch
CWE-94
High · CVSS 8.8
EPSS 1.5% (71th pct)2023-12-22
High vulnerability · 2023-12-22
CVE-2022-39337
Patch
CWE-284
High · CVSS 7.5
EPSS 1.1% (62th pct)2023-12-22

Common weakness types

The CWE weakness categories most often found in Apache Software Foundation hertzbeat CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Apache Software Foundation hertzbeat CVEs were published each year.

2023

3

2024

9

2025

3

2026

1

Other Apache Software Foundation products

Browse vulnerabilities for other products by Apache Software Foundation.

http server342 CVEs tomcat251 CVEs airflow181 CVEs Apache Airflow136 CVEs Apache HTTP Server125 CVEs httpd125 CVEs Apache Tomcat113 CVEs struts86 CVEs

All Apache Software Foundation vulnerabilities

Frequently asked questions

Common questions about Apache Software Foundation hertzbeat vulnerabilities.

How many CVEs does Apache Software Foundation hertzbeat have?: Apache Software Foundation hertzbeat has 16 published CVE records since 2023.
How many Apache Software Foundation hertzbeat CVEs are in CISA KEV?: None of Apache Software Foundation hertzbeat's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for Apache Software Foundation hertzbeat vulnerabilities?: Yes — 5 of Apache Software Foundation hertzbeat's CVEs have a known public exploit.
Which versions of Apache Software Foundation hertzbeat are affected?: 28 distinct Apache Software Foundation hertzbeat versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Apache Software Foundation hertzbeat CVEs?: Apache Software Foundation hertzbeat's CVEs most often map to these CWE weakness types: CWE-502 (Deserialization of Untrusted Data), CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), CWE-643 (Improper Neutralization of Data within XPath Expressions ('XPath Injection')), CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')).
How many critical Apache Software Foundation hertzbeat vulnerabilities are there?: Apache Software Foundation hertzbeat has 4 critical and 11 high-severity CVEs.
What is the average severity of Apache Software Foundation hertzbeat CVEs?: The average CVSS base score across Apache Software Foundation hertzbeat's scored CVEs is 8.7.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Apache Software Foundation hertzbeat vulnerabilities

Monitor new Apache Software Foundation hertzbeat vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

67ad4b04ef1b06b62f0e5030a26d0ca069294fa3

1 CVE

97c3f14446d1c96d1fc993df111684926b6cce171 CVE

ac5970c6ceb64fafe237fc895243df5f21e408761 CVE

f794b0d82be49c596c04a042976446559eb315ef1 CVE