Technology · Oracle
Oracle GraalVM for JDK vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 58 vulnerabilities in Oracle GraalVM for JDK: 0 in the last 7 days and 35 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-114820, was published on 24 October 2026. 33 vulnerabilities in the last four weeks, up 3200% on the four before (1). 2 critical against 0.
- Last 7 days
- 0
- Last 90 days
- 35
- Critical, all time
- 2
- Exploited in the wild
- 0
About Oracle GraalVM for JDK
GraalVM for JDK is a high-performance runtime that provides support for multiple programming languages and ahead-of-time compilation.
Latest Oracle GraalVM for JDK vulnerabilities
- CVE-2026-114820: Oracle Java SE JSSE protocol handling vulnerabilitycriticalCVSS 9.1
- CVE-2026-91403: Oracle Java SE JSSE remote data exposure and modificationcriticalCVSS 9.1
- CVE-2026-91487: Oracle Java SE compiler vulnerability in data accessmediumCVSS 4.8
- CVE-2026-91464: Oracle Java SE JGSS information disclosuremediumCVSS 5.3
- CVE-2026-91463: Oracle Java SE JGSS information exposure with user interactionmediumCVSS 5.3
- CVE-2026-91462: Oracle Java SE JGSS integrity bypassmediumCVSS 5.9
- CVE-2026-91453: Oracle Java SE integrity bypass in Lightweight HTTP ServermediumCVSS 5.3
- CVE-2026-91452: Oracle Java SE networking data integrity bypassmediumCVSS 5.3
- CVE-2026-91451: Oracle Java SE integrity bypass in NetworkingmediumCVSS 5.3
- CVE-2026-91418: Oracle Java SE denial of service in ImageIOmediumCVSS 5.3
- CVE-2026-91415: Oracle Java SE 2D graphics denial of service and data accesshighCVSS 7
- CVE-2026-91411: Oracle Java SE JGSS denial of service and data accessmediumCVSS 6.5
- CVE-2026-91410: Oracle Java SE partial denial of service in Libraries componentmediumCVSS 5.3
- CVE-2026-91398: Oracle Java SE networking vulnerability via SOCKS5mediumCVSS 6.8
- CVE-2026-91396: Oracle Java SE integrity and availability vulnerability in UtilitymediumCVSS 6.5
- CVE-2026-91395: Oracle Java SE data integrity and denial of service in UtilitymediumCVSS 6.5
- CVE-2026-91394: Oracle Java SE networking information disclosuremediumCVSS 5.9
- CVE-2026-91382: Oracle Java SE 2D graphics vulnerabilitymediumCVSS 6.5
- CVE-2026-91380: Oracle Java SE data access vulnerability in Utility componentmediumCVSS 4
- CVE-2026-91379: Oracle Java SE integrity vulnerability in JDK toolsmediumCVSS 4.7
- CVE-2026-91375: Oracle Java SE integrity violation in Libraries componentmediumCVSS 4.7
- CVE-2026-91374: Oracle Java SE data access vulnerability in ServiceabilitymediumCVSS 4.8
- CVE-2026-91373: Oracle Java SE JSSE denial of servicemediumCVSS 5.3
- CVE-2026-91332: Oracle Java SE networking integrity bypassmediumCVSS 5.3
- CVE-2026-87294: Oracle Java SE security API data integrity flawmediumCVSS 6.5
Most severe Oracle GraalVM for JDK vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-114820: Oracle Java SE JSSE protocol handling vulnerabilitycriticalCVSS 9.1
- CVE-2026-91403: Oracle Java SE JSSE remote data exposure and modificationcriticalCVSS 9.1
- CVE-2026-62574: Oracle Java SE and GraalVM compromise in Install componenthighCVSS 7.8
- CVE-2026-21945: Oracle Java SE and GraalVM denial of service in Security componenthighCVSS 7.5EPSS 0.5%
- CVE-2026-22016: Oracle Java SE JAXP information disclosurehighCVSS 7.5EPSS 0.4%
- CVE-2026-34282: Oracle Java SE and GraalVM denial of service in Networking componenthighCVSS 7.5EPSS 0.3%
- CVE-2026-47063: Oracle Java SE and GraalVM integrity vulnerability in LibrarieshighCVSS 7.5
- CVE-2025-53066: Oracle Java SE and GraalVM Information Exposure in JAXPhighCVSS 7.5
- CVE-2026-21932: Oracle Java SE improper URI handling in AWT and JavaFXhighCVSS 7.4EPSS 0.3%
- CVE-2026-83368: Oracle GraalVM Compiler vulnerability allowing unauthorized data accesshighCVSS 7EPSS 0.3%
Vulnerabilities per week
33 vulnerabilities in the last four weeks, up 3200% on the four before (1). 2 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 1 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 1 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 33 | 2 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Oracle GraalVM for JDK vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/graalvm-for-jdk)<a href="https://junglewise.ai/threats/technologies/graalvm-for-jdk"><img src="https://junglewise.ai/threats/technologies/graalvm-for-jdk/badge.svg" alt="Oracle GraalVM for JDK vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/graalvm-for-jdk.json, and this page as text at https://junglewise.ai/threats/technologies/graalvm-for-jdk.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Oracle GraalVM for JDK vulnerabilities", https://junglewise.ai/threats/technologies/graalvm-for-jdk, 9 November 2026.