JRE vulnerabilities

29 known vulnerabilities in JRE from Oracle. 26 are rated high or critical, and 13 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  Oracle Java SE: Improper Access Control

  CVE-2026-62574Jul 21, 2026Oracle

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle Gra

• 7.5 High severity

  Oracle Java SE: Improper Access Control

  CVE-2026-47063Jul 21, 2026Oracle

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0

• 7.4 High severity

  Oracle Java SE: Deserialization of Untrusted Data

  CVE-2026-47058Jul 21, 2026Oracle

  Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to com

• 7.5 High severity

  Oracle Java SE: Uncontrolled Resource Consumption

  CVE-2026-47057Jul 21, 2026Oracle

  Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compr

• 7.5 High severity

  Oracle Java SE: Uncontrolled Resource Consumption

  CVE-2026-34282Apr 21, 2026Oracle

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle

• 7.5 High severity

  Oracle Java SE: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-22016Apr 21, 2026Oracle

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2

• 7.5 High severity

  Oracle Java SE: Uncontrolled Resource Consumption

  CVE-2026-21945Jan 20, 2026Oracle

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.

• 7.4 High severity

  Oracle Java SE: Improper Validation of Specified Type of Input

  CVE-2026-21932Jan 20, 2026Oracle

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9,

• 7.5 High severity

  Oracle Java SE: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-53066Oct 21, 2025Oracle

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM

• 8.6 High severity

  Oracle Java SE: Improper Access Control

  CVE-2025-50059Jul 15, 2025Oracle

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle Graa

• 7.4 High severity

  Oracle Java SE: Improper Access Control

  CVE-2025-21587Apr 15, 2025Oracle

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE:8u441, 8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24; Oracle GraalVM

• 7.4 High severity

  Java SE JDK and JRE: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2024-21147Jul 16, 2024OracleEPSS 1.13%

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle

• 7.4 High severity

  Java SE JDK and JRE: Improper Access Control

  CVE-2024-20952Jan 16, 2024Oracle

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM

• 7.5 High severity

  Java SE JDK and JRE: Improper Access Control

  CVE-2024-20932Jan 16, 2024Oracle

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 17.0.9; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Ente

• 7.4 High severity

  Java SE JDK and JRE: Improper Access Control

  CVE-2024-20918Jan 16, 2024Oracle

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM f

• 8.8 High severity

  Apple Multiple Products WebKit Code Execution Exploited

  CVE-2023-41993Sep 21, 2023AppleEPSS 23.7%

  The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16

• 7.5 High severity

  Apache Xalan-J: Incorrect Conversion between Numeric Types

  CVE-2022-34169Jul 19, 2022ApacheEPSS 81.8%

  The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are rec

• 9.8 Critical severity

  Oracle Java SE and JRockit Unspecified Exploited

  CVE-2016-3427Apr 21, 2016OracleEPSS 92.3%

  Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

• 5.0 Medium severity

  Oracle Java SE Integrity Check Exploited

  CVE-2015-4902Oct 22, 2015OracleEPSS 13.6%

  Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

• 9.8 Critical severity

  Oracle Java SE and Java SE Embedded Remote Code Execution Exploited

  CVE-2015-2590Jul 16, 2015OracleEPSS 25.5%

  Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-201

• 10.0 High severity

  Oracle Java SE Unspecified Exploited

  CVE-2013-2465Jun 18, 2013OracleEPSS 98.8%

  Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availa

• 4.3 Medium severity

  Oracle JRE Unspecified Exploited

  CVE-2013-2423Apr 17, 2013OracleEPSS 85.2%

  Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the A

• 5.0 Medium severity

  Oracle JRE Sandbox Bypass Exploited

  CVE-2013-0431Jan 31, 2013OracleEPSS 90.1%

  Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a

• 10.0 High severity

  Oracle JRE Remote Code Execution Exploited

  CVE-2013-0422Jan 10, 2013OracleEPSS 97.1%

  Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrie

• 10.0 High severity

  Oracle Java SE Sandbox Bypass Exploited

  CVE-2012-5076Oct 16, 2012OracleEPSS 91.3%

  Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.

• 9.8 Critical severity

  Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Exploited

  CVE-2012-4681Aug 28, 2012OracleEPSS 98.5%

  Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder

• 10.0 High severity

  Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Exploited

  CVE-2012-1723Jun 16, 2012OracleEPSS 93.6%

  Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and ava

• 9.8 Critical severity

  Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Exploited

  CVE-2011-3544Oct 19, 2011OracleEPSS 96.7%

  Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availabilit

• 9.8 Critical severity

  Oracle JRE Unspecified Exploited

  CVE-2010-0840Apr 1, 2010OracleEPSS 96.3%

  Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the p