Jdk
Vendor:
First CVE: Jun 30, 2007 · Active for 19 years
791
Total CVEs
More Total CVEs than 100% of tracked products
41.6
Avg CVEs / Year
Higher CVE frequency than 99% of tracked products
6.5
Avg CVSS
Higher Avg CVSS than 28% of tracked products
1.1%
KEV Rate
Higher KEV Rate than 96% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Jdk over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jun 30, 2007
19 years ago
Most Recent CVE
Apr 21, 2026
94 days ago
CVE Severity & Scoring
Jdk791 CVEs
16%
44%
35%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local22 (2.8%)
Network347 (43.9%)
Unknown421 (53.2%)
Physical1 (0.1%)
Adjacent Network0 (0.0%)
Attack Complexity
Low155 (19.6%)
High215 (27.2%)
Unknown421 (53.2%)
User Interaction
None239 (30.2%)
Unknown421 (53.2%)
Required131 (16.6%)
Privileges Required
Low11 (1.4%)
High0 (0.0%)
None359 (45.4%)
Unknown421 (53.2%)
Top CVEs
Signals from CVEs in this product scope (791 CVEs).
791 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-22965CRITICAL A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run | Apr 1, 2022 | 9.8 | 98 | YES | YES |
CVE-2013-0422CRITICAL Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServe | Jan 10, 2013 | 9.8 | 98 | YES | YES |
CVE-2012-4681CRITICAL Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted app | Aug 28, 2012 | 9.8 | 98 | YES | YES |
CVE-2012-1723CRITICAL Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 a | Jun 16, 2012 | 9.8 | 98 | YES | YES |
CVE-2011-3544CRITICAL Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications | Oct 19, 2011 | 9.8 | 98 | YES | YES |
CVE-2016-3427CRITICAL Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and avai | Apr 21, 2016 | 9.8 | 95 | YES | NO |
CVE-2013-1493HIGH The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attacke | Mar 5, 2013 | 10.0 | 89 | NO | YES |
CVE-2012-5088HIGH Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and | Oct 16, 2012 | 10.0 | 87 | NO | YES |
CVE-2013-2460HIGH Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentialit | Jun 18, 2013 | 9.3 | 86 | NO | YES |
CVE-2013-1488HIGH The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vecto | Mar 8, 2013 | 10.0 | 85 | NO | YES |
Exploit Exposure
Signals from CVEs in this product scope (791 CVEs).
CISA KEV
9 CVEs
1.1% of CVEs· 96th percentile
Metasploit
14 CVEs
1.8% of CVEs· 96th percentile
Nuclei
1 CVE
0.1% of CVEs· 96th percentile
ExploitDB
23 CVEs
2.9% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (791 CVEs).
Media Mentions
Signals from CVEs in this product scope (791 CVEs).
Top CNAs Publishing CVEs For Jdk
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 9.0.1 | 19 | 5.8 | 4.0% | 0 | 0 |
| 8.0 | 2 | 8.7 | 4.6% | 0 | 0 |
| 7.0 | 2 | 7.5 | 4.3% | 0 | 0 |
| 26 | 7 | 5.0 | 0.4% | 0 | 0 |
| 25.0.2 | 7 | 5.0 | 0.4% | 0 | 0 |
| 25.0.1 | 5 | 5.9 | 0.4% | 0 | 0 |
| 25 | 3 | 5.7 | 0.5% | 0 | 0 |
| 24.0.1 | 5 | 6.7 | 0.6% | 0 | 0 |
| 24 | 3 | 5.9 | 0.7% | 0 | 0 |
| 23.0.1 | 1 | 4.8 | 1.0% | 0 | 0 |
| 23 | 5 | 3.9 | 0.9% | 0 | 0 |
| 22.0.1 | 9 | 4.4 | 1.1% | 0 | 0 |
| 21.0.9 | 4 | 6.5 | 0.4% | 0 | 0 |
| 21.0.8 | 3 | 5.7 | 0.5% | 0 | 0 |
| 21.0.7 | 4 | 7.4 | 0.6% | 0 | 0 |
| 21.0.6 | 3 | 5.9 | 0.7% | 0 | 0 |
| 21.0.5 | 1 | 4.8 | 1.0% | 0 | 0 |
| 21.0.4 | 4 | 4.0 | 1.0% | 0 | 0 |
| 21.0.3 | 5 | 4.9 | 1.1% | 0 | 0 |
| 21.0.2 | 4 | 3.7 | 1.1% | 0 | 0 |