What’s Vulnerable › Products

dromara hertzbeat vulnerabilities

16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your dromara hertzbeat version is affected

Latest dromara hertzbeat vulnerabilities

• CVE-2026-24343 — Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions (CVSS 8.8)
• CVE-2025-48208 — Apache HertzBeat (incubating): Jmx JNDI injection vulnerability (CVSS 8.8)
• CVE-2025-24404 — Apache HertzBeat (incubating): RCE by parse http sitemap xml response (CVSS 8.8)
• CVE-2024-56736 — Apache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config Oss (CVSS 6.5)
• CVE-2024-45791 — Apache HertzBeat: Exposure sensitive token via http GET method with query string (CVSS 7.5)
• CVE-2024-45505 — Apache HertzBeat: Exists Native Deser RCE and file writing vulnerabilities (CVSS 8.8)
• CVE-2024-41151 — Apache HertzBeat: RCE by notice template injection vulnerability (CVSS 8.8)
• CVE-2024-42323 — Apache HertzBeat: RCE by snakeYaml deser load malicious xml (CVSS 8.8)
• CVE-2024-42362 — GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import (CVSS 8.8)
• CVE-2024-42361 — GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull} (CVSS 9.8)
• CVE-2023-51653 — Hertzbeat JMX JNDI RCE (CVSS 9.8)
• CVE-2023-51389 — HertzBeat SnakeYAML Deser RCE (CVSS 9.8)
• CVE-2023-51388 — HertzBeat AviatorScript Inject RCE (CVSS 9.8)
• CVE-2023-51650 — Unauthorized access vulnerability on three interfaces (CVSS 7.5)
• CVE-2023-51387 — Expression Injection Vulnerability in Hertzbeat (CVSS 8.8)
• CVE-2022-39337 — Permission bypass due to incorrect configuration in github.com/dromara/hertzbeat (CVSS 7.5)