Sign inStart freeBook a demo

Java vulnerabilitiesRanked by how likely they are to be used.

Product5 versions
The short answer

Java is made by Sun. We track 14 published vulnerabilities listed under that exact name, across 5 versions. None of them is on the list of flaws known to be exploited today. Sun lists newer releases under their own names, such as Java System Web Server, so check those pages too.

See the riskiest flaws

We keep watching the known-exploited list.

Other names

Is Java listed under other names? Yes.

Sun also lists Java under more specific names, such as Java System Web Server and Java System Application Server. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.

Known exploited

Which Java vulnerabilities are being exploited?

This is the list that matters most: flaws criminals are using now.

None of Java's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.

Exploit likelihood

Which Java flaws are most likely to be used?

Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.

50% or more10% to 49%Under 10%
  1. 9.4%
    CVE-2010-0887Critical

    Unspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business JDK and JRE 6 Update 18 and 19 allows remote attackers to affect confidentiality, integrity, and availability via...

    CVSS10.0Published20 Apr 2010
  2. 4.6%
    CVE-2009-1102Medium

    Unspecified vulnerability in the Virtual Machine in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to access files and execute arbitrary code via...

    CVSS6.4Published25 Mar 2009
  3. 4.5%
    CVE-2009-1103Medium

    Unspecified vulnerability in the Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier...

    CVSS6.4Published25 Mar 2009
  4. 3.6%
    CVE-1999-0440High

    The byte code verifier component of the Java Virtual Machine (JVM) allows remote execution through malicious web pages.

    CVSS7.5Published1 Mar 1999
  5. 3.6%
    CVE-2009-1105High

    The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 allows user-assisted remote attackers to cause a trusted applet to run in an older JRE version, which can...

    CVSS7.5Published25 Mar 2009
  6. 2.8%
    CVE-2009-1107Medium

    The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier, and 5.0 Update 17 and earlier, allows remote attackers to trick a user into trusting a signed applet via...

    CVSS4.3Published25 Mar 2009
  7. 2.5%
    CVE-2005-2530Critical

    Unspecified vulnerability in Java 1.3.1 before 1.3.1_16 on Apple Mac OS X allows an untrusted applet to gain privileges, related to "Mac OS X specific extensions."

    CVSS10.0Published31 Dec 2005
  8. 2.4%
    CVE-2008-3440High

    Sun Java 1.6.0_03 and earlier versions, and possibly later versions, does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update,...

    CVSS7.5Published1 Aug 2008
  9. 2.3%
    CVE-2005-2529Critical

    Unspecified vulnerability in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to gain privileges via unspecified attack vectors relating to "the utility used to update Java shared archives."

    CVSS10.0Published31 Dec 2005
  10. 2.2%
    CVE-2009-1104Medium

    The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; and 1.4.2_19 and earlier does not prevent Javascript that is loaded from the...

    CVSS5.8Published25 Mar 2009
Precursor Intelligence

Running Java? We'll keep checking.

Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.

  1. Tell us what you runPick your software from a list, or let us work it out from your website.
  2. We match it to every flawOver 400,000 published flaws, checked against your list.
  3. Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
  4. Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Start free →Book a demo

Free plan, no card needed. Nothing to install.

FAQ

Common questions, answered plainly.

Something else? Talk to the team →

We track 14 published vulnerabilities listed under the name Java, across 5 versions.

None of Java's vulnerabilities is on the list of flaws known to be exploited today.

Sun also lists Java under more specific names, such as Java System Web Server and Java System Application Server. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.

Create a Precursor Intelligence account and track Java. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.

Keep exploring