Technology · Oracle
Oracle Java SE vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 92 vulnerabilities in Oracle Java SE: 0 in the last 7 days and 43 in the last 90 days, 13 of them critical and 8 exploited in the wild. The most recent, CVE-2026-114820, was published on 24 October 2026. 40 vulnerabilities in the last four weeks, up from none in the four before. 2 critical against 0.
- Last 7 days
- 0
- Last 90 days
- 43
- Critical, all time
- 13
- Exploited in the wild
- 8
About Oracle Java SE
Java SE is Oracle's standard Java programming language platform for application development.
Latest Oracle Java SE vulnerabilities
- CVE-2026-114820: Oracle Java SE JSSE protocol handling vulnerabilitycriticalCVSS 9.1
- CVE-2026-91403: Oracle Java SE JSSE remote data exposure and modificationcriticalCVSS 9.1
- CVE-2026-91487: Oracle Java SE compiler vulnerability in data accessmediumCVSS 4.8
- CVE-2026-91484: Oracle Java SE Java plugin sandbox escapehighCVSS 7.5
- CVE-2026-91464: Oracle Java SE JGSS information disclosuremediumCVSS 5.3
- CVE-2026-91463: Oracle Java SE JGSS information exposure with user interactionmediumCVSS 5.3
- CVE-2026-91462: Oracle Java SE JGSS integrity bypassmediumCVSS 5.9
- CVE-2026-91453: Oracle Java SE integrity bypass in Lightweight HTTP ServermediumCVSS 5.3
- CVE-2026-91452: Oracle Java SE networking data integrity bypassmediumCVSS 5.3
- CVE-2026-91451: Oracle Java SE integrity bypass in NetworkingmediumCVSS 5.3
- CVE-2026-91418: Oracle Java SE denial of service in ImageIOmediumCVSS 5.3
- CVE-2026-91417: Oracle Java SE and GraalVM Enterprise denial of service in CORBAmediumCVSS 5.3
- CVE-2026-91415: Oracle Java SE 2D graphics denial of service and data accesshighCVSS 7
- CVE-2026-91411: Oracle Java SE JGSS denial of service and data accessmediumCVSS 6.5
- CVE-2026-91410: Oracle Java SE partial denial of service in Libraries componentmediumCVSS 5.3
- CVE-2026-91398: Oracle Java SE networking vulnerability via SOCKS5mediumCVSS 6.8
- CVE-2026-91396: Oracle Java SE integrity and availability vulnerability in UtilitymediumCVSS 6.5
- CVE-2026-91395: Oracle Java SE data integrity and denial of service in UtilitymediumCVSS 6.5
- CVE-2026-91394: Oracle Java SE networking information disclosuremediumCVSS 5.9
- CVE-2026-91385: Oracle Java SE data integrity vulnerability in JavaFXmediumCVSS 5.4
- CVE-2026-91382: Oracle Java SE 2D graphics vulnerabilitymediumCVSS 6.5
- CVE-2026-91380: Oracle Java SE data access vulnerability in Utility componentmediumCVSS 4
- CVE-2026-91379: Oracle Java SE integrity vulnerability in JDK toolsmediumCVSS 4.7
- CVE-2026-91375: Oracle Java SE integrity violation in Libraries componentmediumCVSS 4.7
- CVE-2026-91374: Oracle Java SE data access vulnerability in ServiceabilitymediumCVSS 4.8
Most severe Oracle Java SE vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2016-3427: Oracle Java SE and JRockit Unspecified Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2013-2465: Oracle Java SE Unspecified Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2012-5076: Oracle Java SE Sandbox Bypass Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2015-2590: Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2012-1723: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2012-0507: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2012-4681: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2015-4902: Oracle Java SE Integrity Check Vulnerabilitycriticalexploited in the wildCVSS 5.3
- CVE-2017-3289: Oracle Java SE insecure class construction in HotspotcriticalCVSS 9.6
- CVE-2017-3272: Oracle Java SE insufficient protected field access checks in LibrariescriticalCVSS 9.6
Vulnerabilities per week
40 vulnerabilities in the last four weeks, up from none in the four before. 2 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 2 | 0 | |
| 24 Aug 2026 | 1 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 40 | 2 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Oracle Java SE vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/java-se)<a href="https://junglewise.ai/threats/technologies/java-se"><img src="https://junglewise.ai/threats/technologies/java-se/badge.svg" alt="Oracle Java SE vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/java-se.json, and this page as text at https://junglewise.ai/threats/technologies/java-se.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Oracle Java SE vulnerabilities", https://junglewise.ai/threats/technologies/java-se, 9 November 2026.