Oracle Graalvm vulnerabilities

197 CVEs affecting Oracle Graalvm, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-62574, published 2026-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-41993: Apple Multiple Products WebKit Code Execution Vulnerability, published 2023-09-21. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2023-09-25. EPSS: 24.3% chance of exploitation in the next 30 days. The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have…
CVE-2019-9515, published 2019-08-13. High severity, CVSS 7.5. EPSS: 87.4% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the…
CVE-2019-9514, published 2019-08-13. High severity, CVSS 7.5. EPSS: 82.8% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that…
CVE-2022-34169, published 2022-07-19. High severity, CVSS 7.5. EPSS: 81.8% chance of exploitation in the next 30 days. The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal…
CVE-2019-9513, published 2019-08-13. High severity, CVSS 7.5. EPSS: 81.6% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the…
CVE-2021-22883, published 2021-03-03. High severity, CVSS 7.5. EPSS: 77.4% chance of exploitation in the next 30 days. Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of…
CVE-2022-21449, published 2022-04-19. High severity, CVSS 7.5. EPSS: 77.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle…
CVE-2020-7774, published 2020-11-17. Critical severity, CVSS 9.8. EPSS: 69.4% chance of exploitation in the next 30 days. The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
CVE-2021-3449, published 2021-03-25. Medium severity, CVSS 5.9. EPSS: 63.5% chance of exploitation in the next 30 days. An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where…
CVE-2019-9511, published 2019-08-13. High severity, CVSS 7.5. EPSS: 59.5% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data…

Latest

CVE-2026-62574, published 2026-07-21. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java…
CVE-2026-60147, published 2026-07-21. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java…
CVE-2026-47063, published 2026-07-21. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java…
CVE-2026-47059, published 2026-07-21. Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE:…
CVE-2026-47027, published 2026-07-21. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK:…
CVE-2026-47021, published 2026-07-21. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE:…
CVE-2026-47010, published 2026-07-21. Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java…
CVE-2026-46968, published 2026-07-21. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK:…
CVE-2026-46917, published 2026-07-21. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE:…
CVE-2026-34282, published 2026-04-21. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java…