CVE-2026-73915

...

CVE-2026-73916

Helidon 3.2.18 (Oracle Fusion Middleware, Imperative Web Server component) is affected by a critical vulnerability (CVSS 9.1) exploitable by an unauthenticated attacker over HTTP, granting unauthorized access to all Helidon-accessible data and enabling creation, deletion, or modification of criti...

CVE-2026-73909

Helidon 3.2.19 (Oracle Fusion Middleware) is affected in its Imperative Web Server component. A difficult-to-exploit, unauthenticated, network-based HTTP attack can grant an attacker unauthorized access to critical or all Helidon-accessible data. CVSS 3.1 scores this 5.9 (Medium) with high confid...

CVE-2026-73908

Helidon 4.5.0's Imperative Web Server component is vulnerable to an unauthenticated, network-accessible HTTP attack (CVSS 7.5, HIGH) allowing unauthorized access to critical or all Helidon-accessible data. Exploitation details are not provided. Patch information is not included in the documents; ...

CVE-2026-73907

CVE-2026-73907 affects Oracle Helidon 3.2.18 in the Imperative Web Server component. An unauthenticated remote attacker can exploit it via HTTP to access all Helidon-accessible data (CVSS 7.5, HIGH). No exploit code or in-the-wild exploitation is documented. See Oracle's CSP August 2026 advisory ...

CVE-2026-73900

...

CVE-2026-73901

Oracle Helidon 4.5.1's Imperative Web Server component is vulnerable to an unauthenticated, network-accessible HTTP attack requiring high complexity. Successful exploitation grants low-confidence unauthorized read and write/delete access to some Helidon data. CVSS 3.1 Base Score 4.8 (Medium). No ...

CVE-2026-73897

...

CVE-2026-73893

...

CVE-2026-73895

Oracle Helidon 3.2.18's Imperative Web Server component is vulnerable; an unauthenticated, network-accessible attacker can exploit it via HTTP to gain unauthorized read access to a subset of Helidon data (CVSS 5.3, Medium). No exploitation details are provided; see Oracle's CSP advisory for patch...

CVE-2026-73894

...

CVE-2026-73892

...

CVE-2026-73890

CVE-2026-73890 affects the Imperative Web Server component of Oracle Helidon 4.5.0 . An unauthenticated attacker with network access can trigger a complete denial of service (hang or repeatable crash) via crafted HTTP/2 requests. The CVSS 3.1 base score is 7.5 (HIGH) with an availability-only imp...

CVE-2026-73887

...

CVE-2026-73888

...

CVE-2026-73883

...

CVE-2026-73885

...

CVE-2026-73880

CVE-2026-73880 affects Helidon 4.5.1's Imperative Web Server component, allowing a high-privileged local attacker to read critical or all Helidon-accessible data (CVSS 4.4, confidentiality-only). No exploit details, patch version, or root cause are provided in the documents; monitor Oracle's advi...

CVE-2026-73881

Oracle's Helidon 4.5.0 (Imperative Web Server component) is vulnerable to an easily exploitable HTTP-based attack requiring low privileges, allowing unauthorized read, insert, update, and delete access to Helidon data. Oracle's August 2026 CPU advisory (cspuaug2026.html) is the primary reference;...

CVE-2026-73881

...