Java vulnerabilities and fixes

CVEs that mention Java, ranked by priority. 109 tracked.

Java has 109 tracked vulnerabilities, 12 critical and 2 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 70. Most recent: 2026-10-24. Highest priority: CVE-2026-82078 (score 87/100).

• CVE-2026-82078 CRITICAL 9.1 EXPLOITED UPGRADE UPGRADE PaperCut NG/MF Unsafe Reflection Vulnerability
• CVE-2026-105133 HIGH 7.3 EXPLOITED UPGRADE Ahsay AhsayCBS Improper Authentication Vulnerability
• CVE-2026-66713 CRITICAL 9.8 UPGRADE Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component  in Apache Software Fou
• CVE-2026-66909 CRITICAL 9.8 UPGRADE Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserializ
• CVE-2026-67919 CRITICAL 9.8 An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, instal
• CVE-2026-60366 CRITICAL 10.0 DOWNGRADE Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Central
• CVE-2026-60367 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Central
• CVE-2026-60372 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Central
• CVE-2026-43871 HIGH 7.5 UPGRADE Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java
• CVE-2026-45112 HIGH 7.5 UPGRADE Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue
• CVE-2026-48586 HIGH 7.5 UPGRADE Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Pyt
• CVE-2026-56452 HIGH 7.5 UPGRADE Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-si
• CVE-2026-69219 HIGH 8.7 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with Rabbit
• CVE-2026-69220 HIGH 8.7 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with Rabbit
• CVE-2026-75935 HIGH 7.5 Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow re
• CVE-2026-75936 HIGH 7.5 Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1
• CVE-2026-111765 HIGH 7.5 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol
• CVE-2026-54078 HIGH 8.7 veraPDF validation model is an implementation of the veraPDF validation model
• CVE-2026-54079 HIGH 8.7 veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair
• CVE-2026-73247 HIGH 8.6 Kestra is an open-source, event-driven orchestration platform
• CVE-2026-91403 CRITICAL 9.1 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-73246 HIGH 7.5 Kestra is an open-source, event-driven orchestration platform
• CVE-2026-60369 CRITICAL 9.9 DOWNGRADE Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Central
• CVE-2026-71270 HIGH 8.6 Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the Custo
• CVE-2026-8798 HIGH 8.7 In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on Intel platform
• CVE-2026-43910 HIGH 8.2 UPGRADE Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver pro
• CVE-2026-67340 HIGH 7.2 ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Ja
• CVE-2026-75840 HIGH 7.5 ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowli
• CVE-2026-9177 CRITICAL 9.4 A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of th
• CVE-2026-57485 HIGH 8.5 Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files
• CVE-2026-59644 HIGH 7.5 UPGRADE In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sende
• CVE-2026-60368 HIGH 8.8 DOWNGRADE Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Central
• CVE-2026-73644 CRITICAL 9.6 OpenDJ is an LDAPv3 compliant directory service
• CVE-2025-30047 CRITICAL 9.4 CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data
• CVE-2026-60373 HIGH 8.8 DOWNGRADE Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Central
• CVE-2026-60439 HIGH 8.8 DOWNGRADE Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Central
• CVE-2026-61246 HIGH 8.8 DOWNGRADE Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Central
• CVE-2026-63337 HIGH 7.5 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with Rabbit
• CVE-2026-70906 HIGH 7.5 Vulnerability in Oracle Java SE (component: 2D)
• CVE-2026-54080 MEDIUM 6.9 veraPDF PDF parser is a PDF parser for veraPDF
• CVE-2026-54081 MEDIUM 6.9 veraPDF PDF parser is a PDF parser for veraPDF
• CVE-2026-60455 HIGH 8.8 DOWNGRADE Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Central
• CVE-2026-111761 MEDIUM 5.8 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol
• CVE-2026-13505 HIGH 8.7 In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3
• CVE-2026-59949 MEDIUM 6.5 yawkat LZ4 Java provides LZ4 compression for Java
• CVE-2025-34156 MEDIUM 6.9 Tibbo AggreGate Network Manager < 6.40.05 exposes sensitive system information through an unauthenticated endp
• CVE-2026-12852 HIGH 7.5 UPGRADE In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bound
• CVE-2026-73243 MEDIUM 5.8 kkFileView is a universal file online preview project based on Spring Boot
• CVE-2026-63335 MEDIUM 6.3 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with Rabbit
• CVE-2026-73244 MEDIUM 5.3 kkFileView is a universal file online preview project based on Spring Boot
• CVE-2026-24330 MEDIUM 6.5 A flaw was found in wildfly-core
• CVE-2026-61308 MEDIUM 6.8 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-83395 MEDIUM 6.5 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-91396 MEDIUM 6.5 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-59652 MEDIUM 6.5 UPGRADE In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.
• CVE-2026-60370 HIGH 7.5 DOWNGRADE Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Central
• CVE-2026-91415 HIGH 7.0 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-101737 MEDIUM 5.9 Vulnerability in Oracle Java SE (component: Compiler)
• CVE-2026-107858 HIGH 7.2 Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (
• CVE-2026-111623 MEDIUM 5.6 Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenti
• CVE-2026-113730 MEDIUM 5.6 OGNL is an Object Graph Navigation Library for Java
• CVE-2026-12148 HIGH 7.5 UPGRADE DOWNGRADE IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbi
• CVE-2026-60371 HIGH 8.0 DOWNGRADE Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Central
• CVE-2026-70681 HIGH 7.5 UPGRADE Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: JRI and other Java
• CVE-2026-91394 MEDIUM 5.9 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking)
• CVE-2026-91395 MEDIUM 6.5 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-91398 MEDIUM 6.8 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-91411 MEDIUM 6.5 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-91418 MEDIUM 5.3 Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition
• CVE-2026-83400 MEDIUM 5.3 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-91373 MEDIUM 5.3 Vulnerability in Oracle Java SE (component: JSSE)
• CVE-2026-18631 MEDIUM 6.3 A vulnerability was identified in jeequan jeepay up to 3.2.9
• CVE-2026-91462 MEDIUM 5.9 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-91648 MEDIUM 5.3 DOWNGRADE Vulnerability in Oracle Essbase (component: Java Based Agent)
• CVE-2026-51025 MEDIUM 6.1 Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker to execute
• CVE-2026-91410 MEDIUM 5.3 Vulnerability in Oracle Java SE (component: Libraries)
• CVE-2026-91417 MEDIUM 5.3 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: C
• CVE-2026-70907 MEDIUM 5.3 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-75876 MEDIUM 6.3 A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta
• CVE-2026-91332 MEDIUM 5.3 Vulnerability in Oracle Java SE (component: Networking)
• CVE-2026-91451 MEDIUM 5.3 Vulnerability in Oracle Java SE (component: Networking)
• CVE-2026-91452 MEDIUM 5.3 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-91453 MEDIUM 5.3 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-91643 MEDIUM 5.3 DOWNGRADE Vulnerability in Oracle Essbase (component: Java Based Agent)
• CVE-2026-58235 MEDIUM 6.3 SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and dat
• CVE-2026-91484 HIGH 7.5 Vulnerability in Oracle Java SE (component: Java plugin)
• CVE-2026-18903 MEDIUM 4.3 A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4
• CVE-2026-17459 MEDIUM 4.3 A vulnerability was determined in perwendel spark up to 2.9.4
• CVE-2026-18710 MEDIUM 6.5 UPGRADE A MongoDB driver component could write sensitive configuration information, including a credential used for ou
• CVE-2026-115803 MEDIUM 4.3 A flaw has been found in Scada-LTS 2.8.0
• CVE-2026-63336 MEDIUM 5.1 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with Rabbit
• CVE-2026-91464 MEDIUM 5.3 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-91487 MEDIUM 4.8 Vulnerability in Oracle Java SE (component: Compiler)
• CVE-2026-91649 MEDIUM 6.0 DOWNGRADE Vulnerability in Oracle Essbase (component: Java Based Agent)
• CVE-2026-91650 LOW 3.7 DOWNGRADE Vulnerability in Oracle Essbase (component: Java Based Agent)
• CVE-2026-91662 MEDIUM 6.4 DOWNGRADE Vulnerability in Oracle Essbase (component: Java Based Agent)
• CVE-2026-60589 LOW 3.7 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-71497 MEDIUM 4.7 jsoup is a Java library for working with real-world HTML
• CVE-2026-91409 LOW 3.7 Vulnerability in Oracle Java SE (component: Networking)
• CVE-2026-91463 MEDIUM 5.3 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-115398 MEDIUM 5.5 Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used b
• CVE-2026-15687 LOW 2.4 A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to c
• CVE-2026-91461 LOW 3.7 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-61634 NONE 0.0 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with Rabbit
• CVE-2026-91400 LOW 3.1 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-91402 LOW 3.1 Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java S
• CVE-2026-91477 LOW 3.1 Vulnerability in the Oracle JavaFX product of Oracle Java SE (component: JavaFX)
• CVE-2026-91397 LOW 3.6 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-48791 LOW 2.0 sigstore-java is a sigstore java client for interacting with sigstore infrastructure

FAQ

How do I fix Java vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Java being exploited right now?

Yes: 2 Java CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which Java CVE should I patch first?

CVE-2026-82078 currently ranks highest (87/100): PaperCut NG/MF Unsafe Reflection Vulnerability.

← Back to latest CVEs