CVE-2026-24343

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat.

This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0.

Users are recommended to upgrade to version 1.8.0, which fixes the issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-643

Affected software

No affected versions have been published.

Timeline

Published
Feb 10, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-243447.3Multiple Buffer Overflows in Admin UI of EZCast Pro II version 1.17478.146 allow attackers to cause a program crash and potential remote codCVE-2026-243458.8Cross-Site Request Forgery in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to bypass authorization checks and gain full acCVE-2026-243469.1Use of well-known default credentials in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to access protected areas in the webCVE-2026-243475.3Improper input validation in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to manipulate files in the /tmp directoryCVE-2026-243486.1Multiple cross-site scripting vulnerabilities in Admin UI of EZCast Pro II version 1.17478.146 allow attackers to execute arbitrary JavaScriCVE-2026-243497.1A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versioCVE-2026-24358.8Tanium addressed a SQL injection vulnerability in Asset.CVE-2026-243505.4PluXml CMS is vulnerable to Stored XSS in file uploading functionality. An authenticated attacker can upload an SVG file containing a maliciCVE-2026-243515.4PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML andCVE-2026-243529.8PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authenticatCVE-2026-243534.3Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access ControlCVE-2026-243546.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Shortcodes & Perform
CVE-2026-24343: High severity, CVSS 8.8 | Vulnix