Oracle Java SE vulnerabilities

6 CVEs affecting Oracle Java SE, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-41041, published 2022-04-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-21349, published 2021-03-23. High severity, CVSS 8.6. EPSS: 46.8% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal…
CVE-2019-7317, published 2019-02-04. Medium severity, CVSS 5.3. EPSS: 9.4% chance of exploitation in the next 30 days. png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
CVE-2022-21496, published 2022-04-19. Medium severity, CVSS 5.3. EPSS: 2.8% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14,…
CVE-2022-21443, published 2022-04-19. Low severity, CVSS 3.7. EPSS: 2.7% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321,…
CVE-2019-10219, published 2019-11-08. Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions.…
CVE-2021-41041, published 2022-04-27. Medium severity, CVSS 5.3. EPSS: 1.1% chance of exploitation in the next 30 days. In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified…