CVE-2026-24343

—

CVSS 3.1

8.8 high

EPSS

<1%p52

Published

Feb 10, 2026 (Feb 10, 2026)

Modified

Jun 17, 2026

Description

Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.

Vendors: apache
Products: hertzbeat
Weakness: CWE-643
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.