Apache

Records4054All Threatist records

Exploited (KEV)47In CISA KEV

CVSS critical776CVSS 9.0–10.0

CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV

TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability CRITICAL 99KEV 2026-10-27 TI-2016-02580 Apache Struts Command Injection Vulnerability CRITICAL 94KEV 2026-10-08 TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CRITICAL 90KEV 2026-08-04 TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability CRITICAL 97KEV 2026-04-16 TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability CRITICAL 98KEV 2025-05-01 TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records

Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

16 records in Hertzbeat · all components

TI-2023-28043 CVE-2023-51388

HertzBeat AviatorScript Inject RCE

HIGH 82

Hertzbeat is a real-time monitoring system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01298 Published 2024-02-22 Fixed in 1.4.1 CWE-74

TI-2024-28347 CVE-2024-42361

GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}

HIGH 81

Hertzbeat is an open source, real-time monitoring system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0108 Published 2024-08-20 No fix listed CWE-89

TI-2023-28044 CVE-2023-51389

HertzBeat SnakeYAML Deser RCE

HIGH 75

Hertzbeat is a real-time monitoring system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01283 Published 2024-02-22 Fixed in 1.4.1 CWE-502

TI-2023-28301 CVE-2023-51650

Unauthorized access vulnerability on three interfaces

HIGH 74

Hertzbeat is an open source, real-time monitoring system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00865 Published 2023-12-22 Fixed in 1.4.1 CWE-862

TI-2024-28348 CVE-2024-42362

GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import

HIGH 73

Hertzbeat is an open source, real-time monitoring system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0133 Published 2024-08-20 Fixed in 1.6.0 CWE-502

TI-2023-28304 CVE-2023-51653

Hertzbeat JMX JNDI RCE

MEDIUM 53

Hertzbeat is a real-time monitoring system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02113 Published 2024-02-22 Fixed in 1.4.1 CWE-74

TI-2024-28312 CVE-2024-42323 · GHSA-8qj3-h82r-hcwc

Apache HertzBeat: RCE by snakeYaml deser load malicious xml

MEDIUM 51

SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.08322 Published 2024-09-21 Fixed in 1.6.0 CWE-502

TI-2024-30540 CVE-2024-45505 · GHSA-8c78-wf5j-v7jx

Apache HertzBeat: Exists Native Deser RCE and file writing vulnerabilities

MEDIUM 44

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat (incubating).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0221 Published 2024-11-18 Fixed in 1.6.1 CWE-77

TI-2024-27501 CVE-2024-41151 · GHSA-jc5h-x77p-hhq6

Apache HertzBeat: RCE by notice template injection vulnerability

MEDIUM 42

Deserialization of Untrusted Data vulnerability in Apache HertzBeat.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00983 Published 2024-11-18 Fixed in 1.6.1 CWE-502

TI-2026-19616 CVE-2026-24343 · GHSA-jr4c-vcm8-65vh

Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions

MEDIUM 41

Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00748 Published 2026-02-10 Fixed in 1.8.0 CWE-643

TI-2025-30555 CVE-2025-48208 · GHSA-q6jp-29q3-rwxv

Apache HertzBeat (incubating): Jmx JNDI injection vulnerability

MEDIUM 41

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache HertzBeat .

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0067 Published 2025-09-09 No fix listed CWE-90

TI-2025-18141 CVE-2025-24404 · GHSA-xp76-33m9-43ww

Apache HertzBeat (incubating): RCE by parse http sitemap xml response

MEDIUM 41

XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00552 Published 2025-09-09 Fixed in 1.7.0 CWE-91

TI-2023-28042 CVE-2023-51387

Expression Injection Vulnerability in Hertzbeat

MEDIUM 41

Hertzbeat is an open source, real-time monitoring system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01449 Published 2023-12-22 Fixed in 1.4.1 CWE-94

TI-2024-30758 CVE-2024-45791 · GHSA-3m64-79r5-56f2

Apache HertzBeat: Exposure sensitive token via http GET method with query string

MEDIUM 40

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00848 Published 2024-11-18 Fixed in 1.6.1 CWE-200

TI-2022-18712 CVE-2022-39337

Permission bypass due to incorrect configuration in github.com/dromara/hertzbeat

LOW 35

Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01102 Published 2023-12-22 No fix listed CWE-284

TI-2024-37619 CVE-2024-56736 · GHSA-gj7g-7f7f-wjr5

Apache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config Oss

LOW 30

Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00664 Published 2025-04-16 Fixed in 1.7.0 CWE-918

Open these records in search →

Critical	776
High	1543
Medium	1572
Low	112
No CVSS	51