Login Request a demo
HE
Product
HertzBeat
by Apache · last CVE Feb 10, 2026
16
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities16In the news0Timeline
Severity mix
Critical 4High 11Medium 1Low 0
Severity
All severities16Critical4High11Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add HertzBeat to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-42361
9.8
1%
Aug 20
GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}
Affected: <= 1.6.0
CVE-2023-51389
9.8
1%
Feb 22
HertzBeat SnakeYAML Deser RCE
Affected: before 1.4.1
CVE-2023-51388
9.8
1%
Feb 22
HertzBeat AviatorScript Inject RCE
Affected: before 1.4.1
CVE-2023-51653
9.8
2%
Feb 22
Hertzbeat JMX JNDI RCE
Affected: before 1.4.1
CVE-2026-24343
8.8
1%
Feb 10
Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions
Affected: 1.7.1 before 1.8.0
CVE-2025-48208
8.8
1%
Sep 9
Apache HertzBeat (incubating): Jmx JNDI injection vulnerability
Affected: before 1.7.3
CVE-2025-24404
8.8
1%
Sep 9
Apache HertzBeat (incubating): RCE by parse http sitemap xml response
Affected: before 1.7.0
CVE-2024-41151
8.8
1%
Nov 18
Apache HertzBeat: RCE by notice template injection vulnerability
Affected: before 1.6.1
CVE-2024-45505
8.8
2%
Nov 18
Apache HertzBeat: Exists Native Deser RCE and file writing vulnerabilities
Affected: before 1.6.1
CVE-2024-42323
8.8
8%
Sep 21
Apache HertzBeat: RCE by snakeYaml deser load malicious xml
Affected: before 1.6.0
CVE-2024-42362
8.8
1%
Aug 20
GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import
Affected: < 1.6.0
CVE-2023-51387
8.8
1%
Dec 22
Expression Injection Vulnerability in Hertzbeat
Affected: before 1.4.1
CVE-2024-45791
7.5
1%
Nov 18
Apache HertzBeat: Exposure sensitive token via http GET method with query string
Affected: before 1.6.1
CVE-2023-51650
7.5
1%
Dec 22
Unauthorized access vulnerability on three interfaces
Affected: before 1.4.1
CVE-2022-39337
7.5
1%
Dec 22
Permission bypass due to incorrect configuration in github.com/dromara/hertzbeat
Affected: before 1.2.1
CVE-2024-56736
6.5
1%
Apr 16
Apache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config Oss
Affected: before 1.7.0
Showing 16