Oracle Jre vulnerabilities
817 known vulnerabilities affecting oracle/jre.
Total CVEs
817
CISA KEV
14
actively exploited
Public exploits
33
Exploited in wild
24
Severity breakdown
CRITICAL205HIGH125MEDIUM356LOW129
Vulnerabilities
Page 17 of 41
CVE-2013-5775P3HIGHCVSS 7.5≤ 1.7.0v1.7.02013-10-16
CVE-2013-5775 [HIGH] CVE-2013-5775: Unspecified vulnerability in the Java SE and JavaFX components in Oracle Java SE 7u40 and earlier an
Unspecified vulnerability in the Java SE and JavaFX components in Oracle Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2013-5777.
nvd
CVE-2016-9842P3HIGHCVSS 8.8v1.6.0-update161v1.7.0-update151+1 more2017-05-23
CVE-2016-9842 [HIGH] CWE-1335 CVE-2016-9842: The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
nvd
CVE-2016-9840P3HIGHCVSS 8.8v1.6.0-update161v1.7.0-update151+1 more2017-05-23
CVE-2016-9840 [HIGH] CVE-2016-9840: inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by lever
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
nvd
CVE-2014-6506P3MEDIUMCVSS 6.8v1.5.0v1.6.0+2 more2014-10-15
CVE-2014-6506 [MEDIUM] CVE-2014-6506: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60,
Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
nvd
CVE-2026-21932P3HIGHCVSS 7.4v1.8.0-update471v1.8.0-update471_b50+4 more2026-01-20
CVE-2026-21932 [HIGH] CWE-1287 CVE-2026-21932: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produ
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.
nvd
CVE-2017-3253P3HIGHCVSS 7.5v1.6v1.7+1 more2017-01-27
CVE-2017-3253 [HIGH] CVE-2017-3253: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: 2
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Em
nvd
CVE-2013-5804P3MEDIUMCVSS 6.4≤ 1.7.0v1.7.0+4 more2013-10-16
CVE-2013-5804 [MEDIUM] CVE-2013-5804: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, and JRockit R27.7.6 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Javadoc.
nvd
CVE-2026-62574P3HIGHCVSS 7.8v1.8.0-update491v11.0.31+4 more2026-07-21
CVE-2026-62574 [HIGH] CWE-284 CVE-2026-62574: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produ
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploit
nvd
CVE-2016-9843P3CRITICALCVSS 9.8v1.6.0v1.7.0+1 more2017-05-23
CVE-2016-9843 [CRITICAL] CVE-2016-9843: The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unsp
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
nvd
CVE-2016-0603P3HIGHCVSS 7.6v1.6.0v1.7.0+1 more2016-02-08
CVE-2016-0603 [HIGH] CVE-2016-0603: Unspecified vulnerability in the Java SE component in Oracle Java SE 6u111, 7u95, 8u71, and 8u72, wh
Unspecified vulnerability in the Java SE component in Oracle Java SE 6u111, 7u95, 8u71, and 8u72, when running on Windows, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install. NOTE: the previous information is from Oracle's Security Alert for CVE-2016-0603. Oracle has not commented on third-party
nvd
CVE-2013-5904P3MEDIUMCVSS 6.8v1.7.02014-01-15
CVE-2013-5904 [MEDIUM] CVE-2013-5904: Unspecified vulnerability in Oracle Java SE 7u45 allows remote attackers to affect confidentiality,
Unspecified vulnerability in Oracle Java SE 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
nvd
CVE-2013-5870P3MEDIUMCVSS 6.8v1.7.02014-01-15
CVE-2013-5870 [MEDIUM] CVE-2013-5870: Unspecified vulnerability in Oracle Java SE 7u45 and JavaFX 2.2.45 allows remote attackers to affect
Unspecified vulnerability in Oracle Java SE 7u45 and JavaFX 2.2.45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX.
nvd
CVE-2015-0484P3MEDIUMCVSS 6.8v1.7.0v1.8.02015-04-16
CVE-2015-0484 [MEDIUM] CVE-2015-0484: Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and Java FX 2.2.76, allows remote attacke
Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0492.
nvd
CVE-2013-5783P3MEDIUMCVSS 6.4≤ 1.6.0v1.6.0+4 more2013-10-16
CVE-2013-5783 [MEDIUM] CVE-2013-5783: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Swing.
nvd
CVE-2012-5071P3MEDIUMCVSS 6.4≤ 1.7.0v1.7.0+3 more2012-10-16
CVE-2012-5071 [MEDIUM] CVE-2012-5071: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality and integrity, related to JMX.
nvd
CVE-2012-5074P3MEDIUMCVSS 6.4≤ 1.7.0v1.7.02012-10-16
CVE-2012-5074 [MEDIUM] CVE-2012-5074: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality and integrity, related to JAX-WS.
nvd
CVE-2012-0547P4UNKNOWNCVSS 0.0PoC≤ 1.7.0v1.7.0+2 more2012-08-30
CVE-2012-0547 [NONE] CVE-2012-0547: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier, and 6 Update 34 and earlier, has no impact and remote attack vectors involving AWT and "a security-in-depth issue that is not directly exploitable but which can be used to aggravate security vulnerabilities that can be directly exploited." NOTE: t
nvd
CVE-2015-8126P3HIGHCVSS 7.5v1.6.0v1.7.0+1 more2015-11-13
CVE-2015-8126 [HIGH] CWE-120 CVE-2015-8126: Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value
nvd
CVE-2012-0503P3HIGHCVSS 7.5≤ 1.6.0v1.6.0+2 more2012-02-15
CVE-2012-0503 [HIGH] CVE-2012-0503: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability, related to I18n.
nvd
CVE-2012-0505P3HIGHCVSS 7.5≤ 1.6.0v1.6.0+2 more2012-02-15
CVE-2012-0505 [HIGH] CVE-2012-0505: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Seriali
nvd