SB20261107477 - Multiple vulnerabilities in Helidon

Description

This security bulletin contains information about 101 vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2026-73923)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

2) Improper input validation (CVE-ID: CVE-2026-60853)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

3) Improper input validation (CVE-ID: CVE-2026-73873)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote authenticated user can exploit this vulnerability to read and manipulate data.

4) Improper input validation (CVE-ID: CVE-2026-73880)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A local privileged user can exploit this vulnerability to gain access to sensitive information.

5) Improper input validation (CVE-ID: CVE-2026-73901)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

6) Improper input validation (CVE-ID: CVE-2026-70727)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

7) Improper input validation (CVE-ID: CVE-2026-73932)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

8) Improper input validation (CVE-ID: CVE-2026-73910)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

9) Improper input validation (CVE-ID: CVE-2026-73906)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

10) Improper input validation (CVE-ID: CVE-2026-73900)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

11) Improper input validation (CVE-ID: CVE-2026-73899)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

12) Improper input validation (CVE-ID: CVE-2026-73895)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

13) Improper input validation (CVE-ID: CVE-2026-73889)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

14) Improper input validation (CVE-ID: CVE-2026-73888)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

15) Improper input validation (CVE-ID: CVE-2026-73877)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

16) Improper input validation (CVE-ID: CVE-2026-73872)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

17) Improper input validation (CVE-ID: CVE-2026-73871)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

18) Improper input validation (CVE-ID: CVE-2026-71161)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

19) Improper input validation (CVE-ID: CVE-2026-71157)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

20) Improper input validation (CVE-ID: CVE-2026-71156)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

21) Improper input validation (CVE-ID: CVE-2026-73919)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote authenticated user can exploit this vulnerability to read and manipulate data.

22) Improper input validation (CVE-ID: CVE-2026-73913)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote authenticated user can exploit this vulnerability to read and manipulate data.

23) Improper input validation (CVE-ID: CVE-2026-73911)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote authenticated user can exploit this vulnerability to read and manipulate data.

24) Improper input validation (CVE-ID: CVE-2026-73881)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote authenticated user can exploit this vulnerability to read and manipulate data.

25) Improper input validation (CVE-ID: CVE-2026-73874)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote authenticated user can exploit this vulnerability to read and manipulate data.

26) Improper input validation (CVE-ID: CVE-2026-71165)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote authenticated user can exploit this vulnerability to read and manipulate data.

27) Improper input validation (CVE-ID: CVE-2026-73909)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

28) Improper input validation (CVE-ID: CVE-2026-70716)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

29) Improper input validation (CVE-ID: CVE-2026-71154)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A local authenticated user can exploit this vulnerability to read and manipulate data.

30) Improper input validation (CVE-ID: CVE-2026-73898)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

31) Improper input validation (CVE-ID: CVE-2026-73870)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

32) Improper input validation (CVE-ID: CVE-2026-73869)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

33) Improper input validation (CVE-ID: CVE-2026-70923)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

34) Improper input validation (CVE-ID: CVE-2026-73896)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read memory contents or crash the application.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read memory contents or crash the application.

35) Improper input validation (CVE-ID: CVE-2026-73914)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read memory contents or crash the application.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read memory contents or crash the application.

36) Improper input validation (CVE-ID: CVE-2026-73904)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

37) Improper input validation (CVE-ID: CVE-2026-73897)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

38) Improper input validation (CVE-ID: CVE-2026-73893)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

39) Improper input validation (CVE-ID: CVE-2026-73892)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

40) Improper input validation (CVE-ID: CVE-2026-73868)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

41) Improper input validation (CVE-ID: CVE-2026-73867)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

42) Improper input validation (CVE-ID: CVE-2026-71162)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

43) Improper input validation (CVE-ID: CVE-2026-71029)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

44) Improper input validation (CVE-ID: CVE-2026-73928)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

45) Improper input validation (CVE-ID: CVE-2026-73886)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

46) Improper input validation (CVE-ID: CVE-2026-73885)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

47) Improper input validation (CVE-ID: CVE-2026-73876)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

48) Improper input validation (CVE-ID: CVE-2026-73875)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

49) Improper Authorization (CVE-ID: CVE-2026-33186)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to bypass authorization.

The vulnerability exists due to authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server to bypass authorization.

50) Improper input validation (CVE-ID: CVE-2026-73933)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

51) Improper input validation (CVE-ID: CVE-2026-73918)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

52) Improper input validation (CVE-ID: CVE-2026-73894)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

53) Improper input validation (CVE-ID: CVE-2026-73891)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

54) Improper input validation (CVE-ID: CVE-2026-60915)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

55) Resource exhaustion (CVE-ID: CVE-2026-42587)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in HttpContentDecompressor and DelegatingDecompressorFrameListener when processing compressed HTTP request bodies with Content-Encoding set to br, zstd, or snappy. A remote attacker can send a specially crafted compressed payload to cause a denial of service.

The configured maxAllocation limit is enforced for gzip and deflate, but is silently ignored for brotli, zstd, and snappy. The issue affects both HTTP/1.1 and HTTP/2 handling.

56) Improper input validation (CVE-ID: CVE-2026-73935)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

57) Improper input validation (CVE-ID: CVE-2026-73934)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

58) Improper input validation (CVE-ID: CVE-2026-73890)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

59) Improper input validation (CVE-ID: CVE-2026-73887)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

60) Improper input validation (CVE-ID: CVE-2026-73938)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

61) Improper input validation (CVE-ID: CVE-2026-73936)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

62) Improper input validation (CVE-ID: CVE-2026-73927)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

63) Improper input validation (CVE-ID: CVE-2026-73915)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

64) Improper input validation (CVE-ID: CVE-2026-73908)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

65) Improper input validation (CVE-ID: CVE-2026-73907)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

66) Improper input validation (CVE-ID: CVE-2026-73903)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

67) Improper input validation (CVE-ID: CVE-2026-73902)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

68) Improper input validation (CVE-ID: CVE-2026-73884)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

69) Improper input validation (CVE-ID: CVE-2026-73883)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

70) Improper input validation (CVE-ID: CVE-2026-73882)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

71) Improper input validation (CVE-ID: CVE-2026-73879)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

72) Improper input validation (CVE-ID: CVE-2026-73878)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

73) Improper input validation (CVE-ID: CVE-2026-71160)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote authenticated user can exploit this vulnerability to execute arbitrary code.

74) Improper input validation (CVE-ID: CVE-2026-71158)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

75) Improper input validation (CVE-ID: CVE-2026-71153)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

76) Improper input validation (CVE-ID: CVE-2026-70908)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

77) Improper input validation (CVE-ID: CVE-2026-71110)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote authenticated user can exploit this vulnerability to read and manipulate data.

78) Improper input validation (CVE-ID: CVE-2026-73937)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to access sensitive information or perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to access sensitive information or perform a denial of service (DoS) attack.

79) Improper input validation (CVE-ID: CVE-2026-73925)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

80) Improper input validation (CVE-ID: CVE-2026-71159)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

81) Improper input validation (CVE-ID: CVE-2026-73931)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

82) Improper input validation (CVE-ID: CVE-2026-73929)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

83) Improper input validation (CVE-ID: CVE-2026-71155)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote authenticated user can exploit this vulnerability to read and manipulate data.

84) Improper input validation (CVE-ID: CVE-2026-73939)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

85) Improper input validation (CVE-ID: CVE-2026-73924)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

86) Improper input validation (CVE-ID: CVE-2026-73922)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

87) Improper input validation (CVE-ID: CVE-2026-73917)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

88) Improper input validation (CVE-ID: CVE-2026-73916)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

89) Improper input validation (CVE-ID: CVE-2026-73866)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

90) Improper input validation (CVE-ID: CVE-2026-73865)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

91) Improper input validation (CVE-ID: CVE-2026-71065)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

92) Improper input validation (CVE-ID: CVE-2026-73920)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to compromise the affected system.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to compromise the affected system.

93) Improper input validation (CVE-ID: CVE-2026-71167)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to compromise the affected system.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to compromise the affected system.

94) Improper input validation (CVE-ID: CVE-2026-71166)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to compromise the affected system.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to compromise the affected system.

95) Improper input validation (CVE-ID: CVE-2026-73921)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

96) Improper input validation (CVE-ID: CVE-2026-73912)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

97) Improper input validation (CVE-ID: CVE-2026-73905)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

98) Improper input validation (CVE-ID: CVE-2026-71164)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

99) Improper input validation (CVE-ID: CVE-2026-71152)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

100) Improper input validation (CVE-ID: CVE-2026-71074)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

101) Improper input validation (CVE-ID: CVE-2026-73930)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Imperative Web Server component in Helidon. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cspuaug2026.html