Technology · Oracle
Oracle Helidon vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 130 vulnerabilities in Oracle Helidon: 0 in the last 7 days and 130 in the last 90 days, 18 of them critical and 0 exploited in the wild. The most recent, CVE-2026-101590, was published on 20 October 2026. 19 vulnerabilities in the last four weeks, up 46% on the four before (13). 1 critical against 0.
- Last 7 days
- 0
- Last 90 days
- 130
- Critical, all time
- 18
- Exploited in the wild
- 0
About Oracle Helidon
Java-based web server and microservices framework with lightweight footprint for building cloud-native applications.
Latest Oracle Helidon vulnerabilities
- CVE-2026-101590: Oracle Helidon microprofile-security authentication bypasscriticalCVSS 9.1
- CVE-2026-101588: Oracle Helidon WebSocket unauthenticated information disclosuremediumCVSS 5.3
- CVE-2026-101587: Oracle Helidon denial of service in webclient HTTP/1mediumCVSS 5.3
- CVE-2026-101586: Oracle Helidon information disclosure in helidon-webclientmediumCVSS 5.3
- CVE-2026-101585: Oracle Helidon CORS authorization bypass in helidon-corshighCVSS 7.2
- CVE-2026-101584: Oracle Helidon information disclosure and denial of service in WebSocket clientmediumCVSS 6.5
- CVE-2026-101583: Oracle Helidon data manipulation vulnerability in helidon-common-mapperhighCVSS 7
- CVE-2026-101582: Oracle Helidon unauthorized information disclosure in vault integrationmediumCVSS 5.8
- CVE-2026-101581: Oracle Helidon DNS resolver spoofing in web clientmediumCVSS 6.5
- CVE-2026-101580: Oracle Helidon JWT authentication bypassmediumCVSS 5.8
- CVE-2026-101579: Oracle Helidon gRPC server unauthorized data access via HTTP/2highCVSS 7.2
- CVE-2026-101578: Oracle Helidon Google Login authentication bypassmediumCVSS 5.3
- CVE-2026-101575: Oracle Helidon LRA unauthorized data access and partial denial of servicemediumCVSS 6.5
- CVE-2026-101574: Oracle Helidon OIDC authentication bypassmediumCVSS 6.9
- CVE-2026-101573: Oracle Helidon HTTP authentication bypassmediumCVSS 6.8
- CVE-2026-101572: Oracle Helidon denial of service in HTTP/2 webclienthighCVSS 7.5
- CVE-2026-101571: Oracle Helidon unauthorized data access via security providermediumCVSS 5.6
- CVE-2026-101569: Oracle Helidon concurrency limits data manipulation and denial of servicemediumCVSS 6.5
- CVE-2026-101568: Oracle Helidon information disclosure in helidon-healthmediumCVSS 5.3
- CVE-2026-87289: Oracle Helidon webserver static content denial of servicehighCVSS 7.5EPSS 0.5%
- CVE-2026-83488: Oracle Helidon unauthorized data access in microprofile-securitymediumCVSS 5.4EPSS 0.2%
- CVE-2026-83480: Oracle Helidon WebSocket denial of servicemediumCVSS 5.3EPSS 0.4%
- CVE-2026-83460: Oracle Helidon LRA unauthorized data accessmediumCVSS 6.5EPSS 0.3%
- CVE-2026-83459: Oracle Helidon media multipart denial of servicemediumCVSS 5.3EPSS 0.4%
- CVE-2026-83458: Oracle Helidon denial of service in JSON parsingmediumCVSS 5.3EPSS 0.4%
Most severe Oracle Helidon vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-73930: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported…criticalCVSS 9.9EPSS 0.4%
- CVE-2026-73921: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported…criticalCVSS 9.8EPSS 0.5%
- CVE-2026-73912: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported…criticalCVSS 9.8EPSS 0.5%
- CVE-2026-73905: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported…criticalCVSS 9.8EPSS 0.5%
- CVE-2026-71164: Oracle Helidon remote code execution in Imperative Web ServercriticalCVSS 9.8EPSS 0.5%
- CVE-2026-71152: Oracle Helidon remote code executioncriticalCVSS 9.8EPSS 0.5%
- CVE-2026-71074: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported…criticalCVSS 9.8EPSS 0.5%
- CVE-2026-73920: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported…criticalCVSS 9.4EPSS 0.5%
- CVE-2026-71167: Oracle Helidon unauthenticated data access and denial of servicecriticalCVSS 9.4EPSS 0.5%
- CVE-2026-71166: Oracle Helidon remote code execution in Imperative Web ServercriticalCVSS 9.4EPSS 0.5%
Vulnerabilities per week
19 vulnerabilities in the last four weeks, up 46% on the four before (13). 1 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 98 | 17 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 13 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 19 | 1 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Oracle Helidon vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/helidon)<a href="https://junglewise.ai/threats/technologies/helidon"><img src="https://junglewise.ai/threats/technologies/helidon/badge.svg" alt="Oracle Helidon vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/helidon.json, and this page as text at https://junglewise.ai/threats/technologies/helidon.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Oracle Helidon vulnerabilities", https://junglewise.ai/threats/technologies/helidon, 9 November 2026.