Oracle Openjdk vulnerabilities

98 CVEs affecting Oracle Openjdk, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-20952, published 2024-01-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-0431: Oracle JRE Sandbox Bypass Vulnerability, published 2013-01-31. Low severity, CVSS 3.7. Actively exploited: in CISA KEV since 2022-05-25. EPSS: 90.2% chance of exploitation in the next 30 days. Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security…
CVE-2022-34169, published 2022-07-19. High severity, CVSS 7.5. EPSS: 81.8% chance of exploitation in the next 30 days. The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal…
CVE-2013-0169, published 2013-02-08. Low severity, CVSS 2.6. EPSS: 35.6% chance of exploitation in the next 30 days. The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check…
CVE-2021-3517, published 2021-05-19. High severity, CVSS 8.6. EPSS: 17% chance of exploitation in the next 30 days. There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the…
CVE-2021-35559, published 2021-10-20. Medium severity, CVSS 5.3. EPSS: 15.9% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle…
CVE-2021-35556, published 2021-10-20. Medium severity, CVSS 5.3. EPSS: 8.5% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle…
CVE-2022-21293, published 2022-01-19. Medium severity, CVSS 5.3. EPSS: 8.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311,…
CVE-2022-21340, published 2022-01-19. Medium severity, CVSS 5.3. EPSS: 7.7% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311,…
CVE-2021-35565, published 2021-10-20. Medium severity, CVSS 5.3. EPSS: 7.4% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM…
CVE-2021-35550, published 2021-10-20. Medium severity, CVSS 5.9. EPSS: 7.4% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM…

Latest

CVE-2024-20952, published 2024-01-16. High severity, CVSS 7.4. EPSS: 0.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java…
CVE-2023-21968, published 2023-04-18. Low severity, CVSS 3.7. EPSS: 1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf,…
CVE-2023-21967, published 2023-04-18. Medium severity, CVSS 5.9. EPSS: 1.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf,…
CVE-2023-21954, published 2023-04-18. Medium severity, CVSS 5.9. EPSS: 1.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf,…
CVE-2023-21939, published 2023-04-18. Medium severity, CVSS 5.3. EPSS: 2.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf,…
CVE-2023-21938, published 2023-04-18. Low severity, CVSS 3.7. EPSS: 1.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf,…
CVE-2023-21937, published 2023-04-18. Low severity, CVSS 3.7. EPSS: 1.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf,…
CVE-2023-21930, published 2023-04-18. High severity, CVSS 7.4. EPSS: 1.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf,…
CVE-2022-21541, published 2022-07-19. Medium severity, CVSS 5.9. EPSS: 2.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333,…
CVE-2022-21540, published 2022-07-19. Medium severity, CVSS 5.3. EPSS: 4.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333,…