CVE-2021-29425

CVE-2021-29425 affects Apache Commons IO up to version 2.6, specifically FileNameUtils.normalize. With inputs such as "//../foo" or "\..\foo", normalization can yield a value that does not escape to higher directories, potentially enabling access to the parent directory if the resulting path is u...

CVE-2021-21409

The CVE concerns Netty’s HTTP/2 codec (io.netty:netty-codec-http2) where, before version 4.1.61.Final, a Content-Length check can be bypassed when a single Http2HeaderFrame with endStream set to true is used. This enables HTTP request smuggling if the request is proxied and translated to HTTP/1.1...

CVE-2021-37136

CVE-2021-37136 : The Bzip2 decompression decoder can set no limit on the decompressed output size, affecting all Bzip2Decoder users. This under- or over-allocates memory during decompression and can trigger an OutOfMemoryError, enabling DoS. Connected IBM/ASTRA entries reiterate the same descript...

CVE-2021-43797

CVE-2021-43797 : Netty prior to 4.1.71.Final fails to validate control chars at the start/end of header names, allowing HTTP request smuggling via crafted transfer-encoding/headers. This can enable the proxy to sanitize header names and forward malformed requests to remote systems that may not re...

CVE-2026-73894

Oracle Helidon 4.5.0's Imperative Web Server component is affected by a HIGH-severity (CVSS 7.3) vulnerability exploitable by an unauthenticated, network-adjacent attacker via HTTP, enabling unauthorized data read/write and partial DoS. No exploitation or patch details are provided; see Oracle's ...

CVE-2022-21404

CVE-2022-21404 affects Oracle Fusion Middleware Helidon (Reactive WebServer). Affected versions are 1.4.10 and 2.0.0-RC1. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Helidon, potentially taking over the Helidon instance. CVSS v3.1 base score 8.1...

CVE-2026-73925

Helidon 1.4.19's Imperative Web Server component is vulnerable to unauthenticated network attacks via HTTP, enabling unauthorized data creation, deletion, modification, and partial read access (CVSS 8.2 HIGH). No patch version or exploitation details are provided in the documents. Monitor Oracle'...

CVE-2026-73916

Helidon 3.2.18 (Oracle Fusion Middleware, Imperative Web Server component) is affected by a critical vulnerability (CVSS 9.1) exploitable by an unauthenticated attacker over HTTP, granting unauthorized access to all Helidon-accessible data and enabling creation, deletion, or modification of criti...

CVE-2026-73877

An unauthenticated, remotely reachable vulnerability in Oracle Helidon's Imperative Web Server (affected version 3.2.18) allows unauthorized read access to a subset of data. CVSS 3.1 scores it Medium (5.3). Oracle's August 2026 security advisory is referenced as the source. No root-cause or fix d...

CVE-2026-73935

CVE-2026-73935 affects Helidon (Oracle Fusion Middleware), specifically the Imperative Web Server component in version 4.5.1 . An unauthenticated attacker with network access via HTTP/2 can trigger a hang or frequently repeatable crash, resulting in a complete denial of service . The CVSS 3.1 bas...

CVE-2026-73871

CVE-2026-73871 affects Oracle Helidon 3.2.18 (Imperative Web Server component). An unauthenticated, network-accessible HTTP attacker can achieve low confidentiality impact (CVSS 5.3). No exploitation is confirmed; no patch version is specified in the provided documents. Oracle's August 2026 CPU a...

CVE-2026-73939

CVE-2026-73939 affects Helidon 3.2.20's Imperative Web Server component in Oracle Fusion Middleware. An unauthenticated remote attacker can exploit it over HTTP to gain unauthorized creation, deletion, or modification access to critical or all Helidon-accessible data (CVSS 8.6 HIGH, scope changed...

CVE-2026-73927

The vulnerability affects Oracle Helidon 3.2.20's Imperative Web Server component. An unauthenticated remote attacker can send crafted HTTP requests to cause a hang or repeatable crash, resulting in complete denial of service (CVSS 7.5). No exploitation evidence or patch details are provided; see...

CVE-2026-73921

Helidon 1.4.20's Imperative Web Server component allows unauthenticated remote HTTP attackers to fully compromise the application (CVSS 9.8). No root cause, affected versions, or patch details are provided. Monitor Oracle's CSPUAug2026 advisory for remediation updates.

CVE-2026-73928

Oracle Helidon 4.5.3 Imperative Web Server component is vulnerable to unauthenticated remote HTTP attacks (CVSS 7.2) allowing unauthorized read/write access to accessible data with scope change; no exploitation details are provided. Oracle has released patches via the August 2026 CPU advisory.

CVE-2026-73929

Oracle Helidon 4.5.3 (Imperative Web Server component) is vulnerable to an unauthenticated, network-accessible attack via HTTP that can cause unauthorized data read/write and partial denial of service. CVSS 3.1 base score 8.3 (HIGH). No exploitation evidence provided; refer to Oracle's August 202...

CVE-2026-73933

Oracle Helidon 4.5.3 Imperative Web Server component allows unauthenticated remote HTTP attackers to read/modify data and cause partial DoS (CVSS 7.3). No exploitation observed. Oracle CSPA August 2026 patch recommended. No specific root cause or fix version provided in documents.

CVE-2026-71166

Oracle Helidon 3.2.18 Imperative Web Server is critically vulnerable (CVSS 9.4) to unauthenticated remote HTTP attacks granting full confidentiality and integrity compromise. Affected component is part of Oracle Fusion Middleware; no patch details or exploitation evidence are provided in the docu...

CVE-2026-71167

Helidon 4.5.0's Imperative Web Server component is critically vulnerable (CVSS 9.4) to unauthenticated, remote HTTP attacks allowing full data compromise and partial DoS. No public exploit or root-cause details are provided; Oracle has released patches per its August 2026 CPU advisory.

CVE-2026-73924

Helidon 1.4.19 (Oracle Fusion Middleware, Imperative Web Server component) has a critical CVSS 9.1 flaw exploitable by unauthenticated, network-based HTTP attackers, enabling unauthorized read/write access to all Helidon data. Oracle's August 2026 CPU advisory (https://www.oracle.com/security-ale...

CVE-2026-73931

Oracle Helidon 4.5.3 (Imperative Web Server component) has an unauthenticated, network-exploitable HIGH-severity flaw (CVSS 8.3) allowing unauthorized data read/write and partial DoS; no patch or exploit details are provided. Monitor Oracle's CSP advisory for remediation guidance.

CVE-2026-73866

Oracle Helidon 4.5.0's Imperative Web Server component contains a critical vulnerability (CVSS 9.1) exploitable by an unauthenticated network attacker via HTTP, granting unauthorized creation, deletion, and modification of all Helidon-accessible data. No patch version, exploit details, or in-the-...

CVE-2026-73885

Oracle Helidon 3.2.18 (Imperative Web Server component) has an easily exploitable, unauthenticated, network-reachable flaw (CVSS 7.2 HIGH) enabling unauthorized read/write/delete of Helidon-accessible data with scope change; no patch version or exploit details are provided. Monitor Oracle CSP (cs...

CVE-2026-71152

Helidon 4.5.0's Imperative Web Server component has a critical CVSS 9.8 flaw allowing unauthenticated remote attackers to fully compromise the server via HTTP. No root cause, exploit code, or patch details are provided; monitoring Oracle's August 2026 security advisory is advised.

CVE-2026-71160

CVE-2026-71160 affects Oracle Helidon 3.2.18 (Imperative Web Server component). A network-accessible, low-privileged attacker can exploit it via HTTP to fully compromise Helidon (HIGH severity, CVSS 7.5). The Oracle CPUP August 2026 advisory is the patch reference; no exploit details are provided...

CVE-2026-73930

Oracle Helidon 4.5.3's Imperative Web Server component is vulnerable: an unauthenticated remote attacker via HTTP can achieve high-integrity access, partial data read, and partial DoS, with CVSS 9.9 (CRITICAL). Exploitation details are not provided. Patch status is not specified; monitor Oracle's...

CVE-2026-73938

CVE-2026-73938 affects Oracle Helidon 4.5.0 (Imperative Web Server component) within Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data or complete access to all Helidon-accessible data. Th...

CVE-2026-73905

Oracle Helidon 4.5.0 (Imperative Web Server component) has a critical CVSS 9.8 flaw: unauthenticated remote attackers via HTTP can fully compromise the server (C/I/A impact). Patch guidance not provided in documents; monitor Oracle CSP (https://www.oracle.com/security-alerts/cspuaug2026.html) for...

CVE-2026-71165

Oracle Helidon 3.2.18's Imperative Web Server component is vulnerable to a CVSS 5.4 medium-severity flaw: an authenticated low-privilege network attacker can exploit it via HTTP to gain unauthorized read and write access to Helidon data. No exploit code or in-the-wild exploitation details are pro...

CVE-2026-73878

CVE-2026-73878 affects Oracle Helidon 3.2.18 (Imperative Web Server component), exploitable by unauthenticated attackers over HTTP for unauthorized data access (CVSS 7.5 HIGH). No exploitation details or fix version are provided; refer to Oracle's August 2026 security alert for patch information.

CVE-2026-73920

CVE-2026-73920 affects Oracle Helidon 4.5.0 (Imperative Web Server component), rated Critical (CVSS 9.4). An unauthenticated remote attacker can exploit it over HTTP to compromise confidentiality and integrity of all accessible data, with partial DoS impact. No root cause, exploit, or patch detai...

CVE-2026-71159

CVE-2026-71159 affects Oracle Helidon 3.2.18 (Imperative Web Server component). An unauthenticated remote attacker can exploit it via HTTP (CVSS 8.2) to access critical data and perform unauthorized data modifications. No root cause, exploit details, or patch version are provided in the documents...

CVE-2026-73874

Oracle Helidon 4.5.0's Imperative Web Server component is vulnerable to an easily exploitable HTTP-based attack requiring low privileges, yielding unauthorized read/write access to Helidon data (CVSS 5.4 Medium). Patch status and affected versions beyond 4.5.0 are not provided in the documents. M...

CVE-2026-73876

Oracle Helidon 4.5.1's Imperative Web Server component is vulnerable; an unauthenticated network attacker can exploit it via HTTP to gain unauthorized read/write access to Helidon data (CVSS 7.2, HIGH). No exploit code is provided; refer to Oracle's August 2026 CPU for patch details.

CVE-2026-73879

Oracle Helidon 4.5.1's Imperative Web Server component is affected by a HIGH severity (CVSS 7.5) unauthenticated, network-reachable integrity vulnerability. No root cause, exploit details, or patch version are provided; monitor Oracle's CSP August 2026 advisory for remediation guidance.

CVE-2026-73880

CVE-2026-73880 affects Helidon 4.5.1's Imperative Web Server component, allowing a high-privileged local attacker to read critical or all Helidon-accessible data (CVSS 4.4, confidentiality-only). No exploit details, patch version, or root cause are provided in the documents; monitor Oracle's advi...

CVE-2026-73883

CVE-2026-73883 affects the Imperative Web Server component of Oracle Helidon (version 3.2.18 ), part of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data or complete access to all Helidon-...

CVE-2026-73922

Oracle Helidon 1.4.19's Imperative Web Server component is critically vulnerable (CVSS 9.1): an unauthenticated, remote attacker via HTTP can compromise confidentiality and integrity of all Helidon-accessible data. No root cause, exploit code, or patch version is provided in the documents; Oracle...

CVE-2026-60915

CVE-2026-60915 affects the Imperative Web Server component of Oracle Helidon 4.5.0 (part of Oracle Fusion Middleware). An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized creation, deletion, modification, and access to critical data across ...

CVE-2026-71074

Oracle Helidon 3.2.18 (Imperative Web Server component) has a critical unauthenticated HTTP-exploitable flaw allowing full takeover. No root cause or patch version is provided; the Oracle CSP August 2026 advisory is the sole reference. No exploit details are available. Upgrade to a patched Helido...

CVE-2026-71158

Oracle Helidon 3.2.18's Imperative Web Server component is vulnerable to an unauthenticated, network-accessible HTTP exploit (CVSS 7.5 HIGH) causing unauthorized access to all Helidon data. No root cause, fix version, or exploit code is provided in the documents. Oracle's August 2026 CPU addresse...

CVE-2026-71161

Oracle Helidon 3.2.18's Imperative Web Server component allows an unauthenticated, network-accessible attacker to trigger a partial denial of service via HTTP. CVSS 3.1 scores it MEDIUM (5.3). Exploitation details are not provided; refer to Oracle's August 2026 CPU advisory for patch information.

CVE-2026-73875

Oracle Helidon 3.2.19's Imperative Web Server component is affected by a network-reachable, unauthenticated vulnerability (CVSS 7.2 HIGH) allowing unauthorized read/write access to data. Oracle's August 2026 CPU advisory is the primary reference; no patch version or exploit details are provided i...

CVE-2026-73890

CVE-2026-73890 affects the Imperative Web Server component of Oracle Helidon 4.5.0 . An unauthenticated attacker with network access can trigger a complete denial of service (hang or repeatable crash) via crafted HTTP/2 requests. The CVSS 3.1 base score is 7.5 (HIGH) with an availability-only imp...

CVE-2026-73917

Oracle Helidon 4.5.0's Imperative Web Server component is vulnerable to unauthenticated remote attacks via HTTP, allowing full confidentiality and integrity compromise of Helidon data (CVSS 9.1, CRITICAL). Affected version: 4.5.0; remediation guidance not provided in available documents.

CVE-2026-73887

CVE-2026-73887 affects Helidon 4.5.0 (Oracle Fusion Middleware, Imperative Web Server component). An unauthenticated remote attacker can exploit this via HTTP/2 to access all Helidon-accessible data (CVSS 7.5, HIGH, confidentiality-only). No exploitation evidence is reported. Oracle's August 2026...

CVE-2026-73888

CVE-2026-73888 affects Oracle Helidon 4.5.0 (Imperative Web Server component). An unauthenticated attacker with network HTTP access can gain unauthorized read access to a subset of Helidon data (CVSS 5.3, MEDIUM, confidentiality-only impact). Exploitation status is not provided in the documents.{

CVE-2026-73893

CVE-2026-73893 affects Oracle Helidon 4.5.0, specifically the Imperative Web Server component. An unauthenticated, network-accessible attacker can exploit this via HTTP to gain unauthorized read, update, insert, and delete access to Helidon data (CVSS 6.5, MEDIUM). Oracle's August 2026 security a...

CVE-2026-73903

Oracle Helidon 4.5.1's Imperative Web Server component is vulnerable to an unauthenticated, network-accessible HTTP attack (CVSS 7.5 HIGH) allowing unauthorized creation, deletion, or modification of critical or all Helidon accessible data. No exploitation evidence is provided; Oracle's August 20...

CVE-2026-73913

Oracle Helidon 4.5.0 , component Imperative Web Server , is vulnerable to an HTTP-based attack. A low-privileged network attacker can exploit this to gain unauthorized read access to a subset of data and unauthorized update/insert/delete access to some data within Helidon. CVSS 3.1 scores it 5.4 ...