CVE-2026-24343

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat.

This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0.

Users are recommended to upgrade to version 1.8.0, which fixes the issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-643

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache HertzBeat	>= 1.7.1, < 1.8.0

References

https://lists.apache.org/thread/b2k3jqwffrbo2sy6bl4n0f68kp8bfo1nMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/02/09/4Mailing List, Third Party Advisory

Timeline

Published: Feb 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-243447.3Multiple Buffer Overflows in Admin UI of EZCast Pro II version 1.17478.146 allow attackers to cause a program crash and potential remote cod CVE-2026-243458.8Cross-Site Request Forgery in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to bypass authorization checks and gain full ac CVE-2026-243469.1Use of well-known default credentials in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to access protected areas in the web CVE-2026-243475.3Improper input validation in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to manipulate files in the /tmp directory CVE-2026-243486.1Multiple cross-site scripting vulnerabilities in Admin UI of EZCast Pro II version 1.17478.146 allow attackers to execute arbitrary JavaScri CVE-2026-243497.1A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versio CVE-2026-24358.8Tanium addressed a SQL injection vulnerability in Asset.CVE-2026-243505.4PluXml CMS is vulnerable to Stored XSS in file uploading functionality. An authenticated attacker can upload an SVG file containing a malici CVE-2026-243515.4PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and CVE-2026-243529.8PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authenticat CVE-2026-243534.3Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control CVE-2026-243546.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Shortcodes & Perform