Hi,
The following vulnerabilities were published for opendjk-8.
CVE-2026-91395[0]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| Utility). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1; Oracle GraalVM for JDK: 17.0.20.1
| and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1.
| Easily exploitable vulnerability allows unauthenticated attacker
| with network access via multiple protocols to compromise Oracle Java
| SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
| Successful attacks of this vulnerability can result in unauthorized
| update, insert or delete access to some of Oracle Java SE, Oracle
| GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data
| and unauthorized ability to cause a partial denial of service
| (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition. Note: This vulnerability can be
| exploited by using APIs in the specified Component, e.g., through a
| web service which supplies data to the APIs. This vulnerability also
| applies to Java deployments, typically in clients running sandboxed
| Java Web Start applications or sandboxed Java applets, that load and
| run untrusted code (e.g., code that comes from the internet) and
| rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5
| (Integrity and Availability impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
CVE-2026-91396[1]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| Utility). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1; Oracle GraalVM for JDK: 17.0.20.1
| and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1.
| Easily exploitable vulnerability allows unauthenticated attacker
| with network access via multiple protocols to compromise Oracle Java
| SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
| Successful attacks of this vulnerability can result in unauthorized
| update, insert or delete access to some of Oracle Java SE, Oracle
| GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data
| and unauthorized ability to cause a partial denial of service
| (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition. Note: This vulnerability can be
| exploited by using APIs in the specified Component, e.g., through a
| web service which supplies data to the APIs. This vulnerability also
| applies to Java deployments, typically in clients running sandboxed
| Java Web Start applications or sandboxed Java applets, that load and
| run untrusted code (e.g., code that comes from the internet) and
| rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5
| (Integrity and Availability impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
CVE-2026-91397[2]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| Serviceability). Supported versions that are affected are Oracle
| Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1,
| 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1;
| Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit
| vulnerability allows unauthenticated attacker with logon to the
| infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition executes to compromise Oracle Java SE,
| Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
| Successful attacks require human interaction from a person other
| than the attacker. Successful attacks of this vulnerability can
| result in unauthorized update, insert or delete access to some of
| Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise
| Edition accessible data and unauthorized ability to cause a partial
| denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM
| for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability
| can be exploited by using APIs in the specified Component, e.g.,
| through a web service which supplies data to the APIs. This
| vulnerability also applies to Java deployments, typically in clients
| running sandboxed Java Web Start applications or sandboxed Java
| applets, that load and run untrusted code (e.g., code that comes
| from the internet) and rely on the Java sandbox for security. CVSS
| 3.1 Base Score 3.6 (Integrity and Availability impacts). CVSS
| Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L).
CVE-2026-91398[3]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| Networking). Supported versions that are affected are Oracle Java
| SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1,
| 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle
| GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit
| vulnerability allows unauthenticated attacker with network access
| via SOCKS5 to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. While the vulnerability is in
| Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise
| Edition, attacks may significantly impact additional products (scope
| change). Successful attacks of this vulnerability can result in
| unauthorized creation, deletion or modification access to critical
| data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM
| Enterprise Edition accessible data. Note: This vulnerability can be
| exploited by using APIs in the specified Component, e.g., through a
| web service which supplies data to the APIs. This vulnerability also
| applies to Java deployments, typically in clients running sandboxed
| Java Web Start applications or sandboxed Java applets, that load and
| run untrusted code (e.g., code that comes from the internet) and
| rely on the Java sandbox for security. CVSS 3.1 Base Score 6.8
| (Integrity impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N).
CVE-2026-91400[4]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| Sound). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;
| Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability
| allows unauthenticated attacker with network access via multiple
| protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. Successful attacks require human
| interaction from a person other than the attacker. Successful
| attacks of this vulnerability can result in unauthorized ability to
| cause a partial denial of service (partial DOS) of Oracle Java SE,
| Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note:
| This vulnerability applies to Java deployments, typically in clients
| running sandboxed Java Web Start applications or sandboxed Java
| applets, that load and run untrusted code (e.g., code that comes
| from the internet) and rely on the Java sandbox for security. This
| vulnerability does not apply to Java deployments, typically in
| servers, that load and run only trusted code (e.g., code installed
| by an administrator). CVSS 3.1 Base Score 3.1 (Availability
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).
CVE-2026-83374[5]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| Security). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;
| Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability
| allows unauthenticated attacker with network access via multiple
| protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. Successful attacks of this
| vulnerability can result in unauthorized creation, deletion or
| modification access to critical data or all Oracle Java SE, Oracle
| GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
| Note: This vulnerability can be exploited by using APIs in the
| specified Component, e.g., through a web service which supplies data
| to the APIs. This vulnerability also applies to Java deployments,
| typically in clients running sandboxed Java Web Start applications
| or sandboxed Java applets, that load and run untrusted code (e.g.,
| code that comes from the internet) and rely on the Java sandbox for
| security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
CVE-2026-91487[6]:
| Vulnerability in Oracle Java SE (component: Compiler). Supported
| versions that are affected are Oracle Java SE: 8u503-perf,
| 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for
| JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition:
| 21.3.19.1.1. Difficult to exploit vulnerability allows
| unauthenticated attacker with network access via multiple protocols
| to compromise Oracle Java SE. Successful attacks of this
| vulnerability can result in unauthorized update, insert or delete
| access to some of Oracle Java SE accessible data as well as
| unauthorized read access to a subset of Oracle Java SE accessible
| data. Note: This vulnerability can only be exploited by supplying
| data to APIs in the specified Component without using Untrusted Java
| Web Start applications or Untrusted Java applets, such as through a
| web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
CVE-2026-83376[7]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| JSSE). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;
| Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability
| allows unauthenticated attacker with network access via TLS to
| compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM
| Enterprise Edition. Successful attacks of this vulnerability can
| result in unauthorized update, insert or delete access to some of
| Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise
| Edition accessible data. Note: This vulnerability can be exploited
| by using APIs in the specified Component, e.g., through a web
| service which supplies data to the APIs. This vulnerability also
| applies to Java deployments, typically in clients running sandboxed
| Java Web Start applications or sandboxed Java applets, that load and
| run untrusted code (e.g., code that comes from the internet) and
| rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7
| (Integrity impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2026-83380[8]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| JAAS). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;
| Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability
| allows unauthenticated attacker with network access via multiple
| protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. Successful attacks of this
| vulnerability can result in unauthorized read access to a subset of
| Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise
| Edition accessible data. Note: This vulnerability can be exploited
| by using APIs in the specified Component, e.g., through a web
| service which supplies data to the APIs. This vulnerability also
| applies to Java deployments, typically in clients running sandboxed
| Java Web Start applications or sandboxed Java applets, that load and
| run untrusted code (e.g., code that comes from the internet) and
| rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3
| (Confidentiality impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2026-91403[9]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| JSSE). Supported versions that are affected are Oracle Java SE:
| 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle
| GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise
| Edition: 21.3.20. Easily exploitable vulnerability allows
| unauthenticated attacker with network access via multiple protocols
| to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM
| Enterprise Edition. Successful attacks of this vulnerability can
| result in unauthorized creation, deletion or modification access to
| critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition accessible data as well as unauthorized
| access to critical data or complete access to all Oracle Java SE,
| Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible
| data. Note: This vulnerability can be exploited by using APIs in the
| specified Component, e.g., through a web service which supplies data
| to the APIs. This vulnerability also applies to Java deployments,
| typically in clients running sandboxed Java Web Start applications
| or sandboxed Java applets, that load and run untrusted code (e.g.,
| code that comes from the internet) and rely on the Java sandbox for
| security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVE-2026-91410[10]:
| Vulnerability in Oracle Java SE (component: Libraries). Supported
| versions that are affected are Oracle Java SE: 8u503, 8u503-perf,
| 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK:
| 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition:
| 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated
| attacker with network access via multiple protocols to compromise
| Oracle Java SE. Successful attacks of this vulnerability can result
| in unauthorized ability to cause a partial denial of service
| (partial DOS) of Oracle Java SE. Note: This vulnerability can be
| exploited by using APIs in the specified Component, e.g., through a
| web service which supplies data to the APIs. This vulnerability also
| applies to Java deployments, typically in clients running sandboxed
| Java Web Start applications or sandboxed Java applets, that load and
| run untrusted code (e.g., code that comes from the internet) and
| rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3
| (Availability impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2026-91411[11]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| JGSS). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1; Oracle GraalVM for JDK: 17.0.20.1
| and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1.
| Difficult to exploit vulnerability allows unauthenticated attacker
| with network access via multiple protocols to compromise Oracle Java
| SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
| Successful attacks of this vulnerability can result in unauthorized
| ability to cause a hang or frequently repeatable crash (complete
| DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM
| Enterprise Edition as well as unauthorized update, insert or delete
| access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition accessible data. Note: This vulnerability
| can be exploited by using APIs in the specified Component, e.g.,
| through a web service which supplies data to the APIs. This
| vulnerability also applies to Java deployments, typically in clients
| running sandboxed Java Web Start applications or sandboxed Java
| applets, that load and run untrusted code (e.g., code that comes
| from the internet) and rely on the Java sandbox for security. CVSS
| 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS
| Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H).
CVE-2026-91415[12]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| 2D). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;
| Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability
| allows unauthenticated attacker with network access via multiple
| protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. Successful attacks of this
| vulnerability can result in unauthorized ability to cause a hang or
| frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle
| GraalVM for JDK, Oracle GraalVM Enterprise Edition as well as
| unauthorized update, insert or delete access to some of Oracle Java
| SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition
| accessible data and unauthorized read access to a subset of Oracle
| Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition
| accessible data. Note: This vulnerability can be exploited by using
| APIs in the specified Component, e.g., through a web service which
| supplies data to the APIs. This vulnerability also applies to Java
| deployments, typically in clients running sandboxed Java Web Start
| applications or sandboxed Java applets, that load and run untrusted
| code (e.g., code that comes from the internet) and rely on the Java
| sandbox for security. CVSS 3.1 Base Score 7.0 (Confidentiality,
| Integrity and Availability impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).
CVE-2026-91417[13]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise
| Edition product of Oracle Java SE (component: CORBA). Supported
| versions that are affected are Oracle Java SE: 8u503 and
| 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily
| exploitable vulnerability allows unauthenticated attacker with
| network access via multiple protocols to compromise Oracle Java SE,
| Oracle GraalVM Enterprise Edition. Successful attacks of this
| vulnerability can result in unauthorized ability to cause a partial
| denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM
| Enterprise Edition. Note: This vulnerability can only be exploited
| by supplying data to APIs in the specified Component without using
| Untrusted Java Web Start applications or Untrusted Java applets,
| such as through a web service. CVSS 3.1 Base Score 5.3 (Availability
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2026-91418[14]:
| Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM
| for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE
| (component: ImageIO). Supported versions that are affected are
| Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1,
| 25.0.4.1, 27; Oracle JavaFX: 21.0.12, 25.0.4, 27; Oracle GraalVM for
| JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition:
| 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated
| attacker with network access via multiple protocols to compromise
| Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition. Successful attacks of this
| vulnerability can result in unauthorized ability to cause a partial
| denial of service (partial DOS) of Oracle Java SE, Oracle JavaFX,
| Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note:
| This vulnerability can be exploited by using APIs in the specified
| Component, e.g., through a web service which supplies data to the
| APIs. This vulnerability also applies to Java deployments, typically
| in clients running sandboxed Java Web Start applications or
| sandboxed Java applets, that load and run untrusted code (e.g., code
| that comes from the internet) and rely on the Java sandbox for
| security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS
| Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2026-91451[15]:
| Vulnerability in Oracle Java SE (component: Networking). Supported
| versions that are affected are Oracle Java SE: 8u503, 8u503-perf,
| 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK:
| 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition:
| 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated
| attacker with network access via multiple protocols to compromise
| Oracle Java SE. Successful attacks of this vulnerability can result
| in unauthorized update, insert or delete access to some of Oracle
| Java SE accessible data. Note: This vulnerability can only be
| exploited by supplying data to APIs in the specified Component
| without using Untrusted Java Web Start applications or Untrusted
| Java applets, such as through a web service. CVSS 3.1 Base Score 5.3
| (Integrity impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2026-91452[16]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| Networking). Supported versions that are affected are Oracle Java
| SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1,
| 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability
| allows unauthenticated attacker with network access via multiple
| protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. Successful attacks of this
| vulnerability can result in unauthorized update, insert or delete
| access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition accessible data. Note: This vulnerability
| can only be exploited by supplying data to APIs in the specified
| Component without using Untrusted Java Web Start applications or
| Untrusted Java applets, such as through a web service. CVSS 3.1 Base
| Score 5.3 (Integrity impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2026-91453[17]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| Lightweight HTTP Server). Supported versions that are affected are
| Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1,
| 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1;
| Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable
| vulnerability allows unauthenticated attacker with network access
| via multiple protocols to compromise Oracle Java SE, Oracle GraalVM
| for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of
| this vulnerability can result in unauthorized update, insert or
| delete access to some of Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition accessible data. Note: This
| vulnerability can only be exploited by supplying data to APIs in the
| specified Component without using Untrusted Java Web Start
| applications or Untrusted Java applets, such as through a web
| service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2026-91461[18]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| JSSE). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;
| Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability
| allows unauthenticated attacker with network access via TLS to
| compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM
| Enterprise Edition. Successful attacks of this vulnerability can
| result in unauthorized update, insert or delete access to some of
| Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise
| Edition accessible data. Note: This vulnerability can only be
| exploited by supplying data to APIs in the specified Component
| without using Untrusted Java Web Start applications or Untrusted
| Java applets, such as through a web service. CVSS 3.1 Base Score 3.7
| (Integrity impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2026-91462[19]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| JGSS). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;
| Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability
| allows unauthenticated attacker with network access via multiple
| protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. Successful attacks of this
| vulnerability can result in unauthorized creation, deletion or
| modification access to critical data or all Oracle Java SE, Oracle
| GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
| Note: This vulnerability can only be exploited by supplying data to
| APIs in the specified Component without using Untrusted Java Web
| Start applications or Untrusted Java applets, such as through a web
| service. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
CVE-2026-91463[20]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| JGSS). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;
| Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability
| allows unauthenticated attacker with network access via multiple
| protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. Successful attacks require human
| interaction from a person other than the attacker. Successful
| attacks of this vulnerability can result in unauthorized access to
| critical data or complete access to all Oracle Java SE, Oracle
| GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
| Note: This vulnerability applies to Java deployments, typically in
| clients running sandboxed Java Web Start applications or sandboxed
| Java applets, that load and run untrusted code (e.g., code that
| comes from the internet) and rely on the Java sandbox for security.
| This vulnerability does not apply to Java deployments, typically in
| servers, that load and run only trusted code (e.g., code installed
| by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).
CVE-2026-91464[21]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| JGSS). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;
| Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability
| allows unauthenticated attacker with network access via multiple
| protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. Successful attacks require human
| interaction from a person other than the attacker. Successful
| attacks of this vulnerability can result in unauthorized access to
| critical data or complete access to all Oracle Java SE, Oracle
| GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
| Note: This vulnerability applies to Java deployments, typically in
| clients running sandboxed Java Web Start applications or sandboxed
| Java applets, that load and run untrusted code (e.g., code that
| comes from the internet) and rely on the Java sandbox for security.
| This vulnerability does not apply to Java deployments, typically in
| servers, that load and run only trusted code (e.g., code installed
| by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).
CVE-2026-91484[22]:
| Vulnerability in Oracle Java SE (component: Java plugin). Supported
| versions that are affected are Oracle Java SE: 8u503 and
| 8u503-perf. Difficult to exploit vulnerability allows low privileged
| attacker with logon to the infrastructure where Oracle Java SE
| executes to compromise Oracle Java SE. While the vulnerability is
| in Oracle Java SE, attacks may significantly impact additional
| products (scope change). Successful attacks of this vulnerability
| can result in unauthorized creation, deletion or modification
| access to critical data or all Oracle Java SE accessible data as
| well as unauthorized access to critical data or complete access to
| all Oracle Java SE accessible data. Note: This vulnerability applies
| to Java deployments, typically in clients running sandboxed Java Web
| Start applications or sandboxed Java applets, that load and run
| untrusted code (e.g., code that comes from the internet) and rely on
| the Java sandbox for security. This vulnerability does not apply to
| Java deployments, typically in servers, that load and run only
| trusted code (e.g., code installed by an administrator). CVSS 3.1
| Base Score 7.5 (Confidentiality and Integrity impacts). CVSS
| Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
CVE-2026-83381[23]:
| Vulnerability in Oracle Java SE (component: Security). Supported
| versions that are affected are Oracle Java SE: 8u503, 8u503-perf,
| 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for
| JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition:
| 21.3.19.1.1. Difficult to exploit vulnerability allows
| unauthenticated attacker with network access via multiple protocols
| to compromise Oracle Java SE. Successful attacks of this
| vulnerability can result in unauthorized update, insert or delete
| access to some of Oracle Java SE accessible data as well as
| unauthorized read access to a subset of Oracle Java SE accessible
| data. Note: This vulnerability can be exploited by using APIs in the
| specified Component, e.g., through a web service which supplies data
| to the APIs. This vulnerability also applies to Java deployments,
| typically in clients running sandboxed Java Web Start applications
| or sandboxed Java applets, that load and run untrusted code (e.g.,
| code that comes from the internet) and rely on the Java sandbox for
| security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
CVE-2026-83387[24]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| JDBC). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;
| Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability
| allows unauthenticated attacker with network access via multiple
| protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. Successful attacks of this
| vulnerability can result in unauthorized access to critical data or
| complete access to all Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition accessible data. Note: This
| vulnerability can be exploited by using APIs in the specified
| Component, e.g., through a web service which supplies data to the
| APIs. This vulnerability also applies to Java deployments, typically
| in clients running sandboxed Java Web Start applications or
| sandboxed Java applets, that load and run untrusted code (e.g., code
| that comes from the internet) and rely on the Java sandbox for
| security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS
| Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-83395[25]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| Networking). Supported versions that are affected are Oracle Java
| SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1,
| 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability
| allows unauthenticated attacker with network access via multiple
| protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. Successful attacks of this
| vulnerability can result in unauthorized update, insert or delete
| access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition accessible data and unauthorized ability
| to cause a partial denial of service (partial DOS) of Oracle Java
| SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note:
| This vulnerability can be exploited by using APIs in the specified
| Component, e.g., through a web service which supplies data to the
| APIs. This vulnerability also applies to Java deployments, typically
| in clients running sandboxed Java Web Start applications or
| sandboxed Java applets, that load and run untrusted code (e.g., code
| that comes from the internet) and rely on the Java sandbox for
| security. CVSS 3.1 Base Score 6.5 (Integrity and Availability
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
CVE-2026-83400[26]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| JAXP). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;
| Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability
| allows unauthenticated attacker with network access via multiple
| protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. Successful attacks of this
| vulnerability can result in unauthorized ability to cause a partial
| denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM
| for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability
| can be exploited by using APIs in the specified Component, e.g.,
| through a web service which supplies data to the APIs. This
| vulnerability also applies to Java deployments, typically in clients
| running sandboxed Java Web Start applications or sandboxed Java
| applets, that load and run untrusted code (e.g., code that comes
| from the internet) and rely on the Java sandbox for security. CVSS
| 3.1 Base Score 5.3 (Availability impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2026-87290[27]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| JAXP). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;
| Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability
| allows unauthenticated attacker with network access via multiple
| protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. Successful attacks of this
| vulnerability can result in unauthorized access to critical data or
| complete access to all Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition accessible data. Note: This
| vulnerability can be exploited by using APIs in the specified
| Component, e.g., through a web service which supplies data to the
| APIs. This vulnerability also applies to Java deployments, typically
| in clients running sandboxed Java Web Start applications or
| sandboxed Java applets, that load and run untrusted code (e.g., code
| that comes from the internet) and rely on the Java sandbox for
| security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS
| Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-87292[28]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| Networking). Supported versions that are affected are Oracle Java
| SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1,
| 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability
| allows unauthenticated attacker with network access via multiple
| protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. Successful attacks of this
| vulnerability can result in unauthorized update, insert or delete
| access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition accessible data. Note: This vulnerability
| can be exploited by using APIs in the specified Component, e.g.,
| through a web service which supplies data to the APIs. This
| vulnerability also applies to Java deployments, typically in clients
| running sandboxed Java Web Start applications or sandboxed Java
| applets, that load and run untrusted code (e.g., code that comes
| from the internet) and rely on the Java sandbox for security. CVSS
| 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2026-87293[29]:
| Vulnerability in Oracle Java SE (component: RMI). Supported
| versions that are affected are Oracle Java SE: 8u503 and
| 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1.
| Difficult to exploit vulnerability allows unauthenticated attacker
| with network access via multiple protocols to compromise Oracle Java
| SE. While the vulnerability is in Oracle Java SE, attacks may
| significantly impact additional products (scope change). Successful
| attacks of this vulnerability can result in unauthorized update,
| insert or delete access to some of Oracle Java SE accessible data as
| well as unauthorized read access to a subset of Oracle Java SE
| accessible data. Note: This vulnerability can only be exploited by
| supplying data to APIs in the specified Component without using
| Untrusted Java Web Start applications or Untrusted Java applets,
| such as through a web service. CVSS 3.1 Base Score 5.4
| (Confidentiality and Integrity impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N).
CVE-2026-87294[30]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| Security). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;
| Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability
| allows unauthenticated attacker with network access via multiple
| protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. Successful attacks of this
| vulnerability can result in unauthorized update, insert or delete
| access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition accessible data as well as unauthorized
| read access to a subset of Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition accessible data. Note: This
| vulnerability can be exploited by using APIs in the specified
| Component, e.g., through a web service which supplies data to the
| APIs. This vulnerability also applies to Java deployments, typically
| in clients running sandboxed Java Web Start applications or
| sandboxed Java applets, that load and run untrusted code (e.g., code
| that comes from the internet) and rely on the Java sandbox for
| security. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
CVE-2026-87367[31]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| JAXP). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;
| Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability
| allows unauthenticated attacker with network access via multiple
| protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. Successful attacks of this
| vulnerability can result in unauthorized update, insert or delete
| access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition accessible data. Note: This vulnerability
| can be exploited by using APIs in the specified Component, e.g.,
| through a web service which supplies data to the APIs. This
| vulnerability also applies to Java deployments, typically in clients
| running sandboxed Java Web Start applications or sandboxed Java
| applets, that load and run untrusted code (e.g., code that comes
| from the internet) and rely on the Java sandbox for security. CVSS
| 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2026-91332[32]:
| Vulnerability in Oracle Java SE (component: Networking). Supported
| versions that are affected are Oracle Java SE: 8u503-perf,
| 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for
| JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition:
| 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated
| attacker with network access via multiple protocols to compromise
| Oracle Java SE. Successful attacks of this vulnerability can result
| in unauthorized update, insert or delete access to some of Oracle
| Java SE accessible data. Note: This vulnerability can be exploited
| by using APIs in the specified Component, e.g., through a web
| service which supplies data to the APIs. This vulnerability also
| applies to Java deployments, typically in clients running sandboxed
| Java Web Start applications or sandboxed Java applets, that load and
| run untrusted code (e.g., code that comes from the internet) and
| rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3
| (Integrity impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2026-91334[33]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| ImageIO). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;
| Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability
| allows unauthenticated attacker with network access via multiple
| protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. Successful attacks of this
| vulnerability can result in unauthorized read access to a subset of
| Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise
| Edition accessible data. Note: This vulnerability can be exploited
| by using APIs in the specified Component, e.g., through a web
| service which supplies data to the APIs. This vulnerability also
| applies to Java deployments, typically in clients running sandboxed
| Java Web Start applications or sandboxed Java applets, that load and
| run untrusted code (e.g., code that comes from the internet) and
| rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7
| (Confidentiality impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2026-91335[34]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| AWT). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;
| Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability
| allows low privileged attacker with network access via multiple
| protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition. Successful attacks require human
| interaction from a person other than the attacker. Successful
| attacks of this vulnerability can result in unauthorized read
| access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition accessible data. Note: This vulnerability
| applies to Java deployments, typically in clients running sandboxed
| Java Web Start applications or sandboxed Java applets, that load and
| run untrusted code (e.g., code that comes from the internet) and
| rely on the Java sandbox for security. This vulnerability does not
| apply to Java deployments, typically in servers, that load and run
| only trusted code (e.g., code installed by an administrator). CVSS
| 3.1 Base Score 2.6 (Confidentiality impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N).
CVE-2026-91373[35]:
| Vulnerability in Oracle Java SE (component: JSSE). Supported
| versions that are affected are Oracle Java SE: 8u503, 8u503-perf,
| 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK:
| 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition:
| 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated
| attacker with network access via TLS to compromise Oracle Java SE.
| Successful attacks of this vulnerability can result in unauthorized
| ability to cause a partial denial of service (partial DOS) of Oracle
| Java SE. Note: This vulnerability can be exploited by using APIs in
| the specified Component, e.g., through a web service which supplies
| data to the APIs. This vulnerability also applies to Java
| deployments, typically in clients running sandboxed Java Web Start
| applications or sandboxed Java applets, that load and run untrusted
| code (e.g., code that comes from the internet) and rely on the Java
| sandbox for security. CVSS 3.1 Base Score 5.3 (Availability
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2026-91374[36]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| Serviceability). Supported versions that are affected are Oracle
| Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1,
| 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1;
| Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit
| vulnerability allows unauthenticated attacker with network access
| via multiple protocols to compromise Oracle Java SE, Oracle GraalVM
| for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of
| this vulnerability can result in unauthorized update, insert or
| delete access to some of Oracle Java SE, Oracle GraalVM for JDK,
| Oracle GraalVM Enterprise Edition accessible data as well as
| unauthorized read access to a subset of Oracle Java SE, Oracle
| GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
| Note: This vulnerability can be exploited by using APIs in the
| specified Component, e.g., through a web service which supplies data
| to the APIs. This vulnerability also applies to Java deployments,
| typically in clients running sandboxed Java Web Start applications
| or sandboxed Java applets, that load and run untrusted code (e.g.,
| code that comes from the internet) and rely on the Java sandbox for
| security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
CVE-2026-91375[37]:
| Vulnerability in Oracle Java SE (component: Libraries). Supported
| versions that are affected are Oracle Java SE: 8u503-perf,
| 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for
| JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition:
| 21.3.19.1.1. Difficult to exploit vulnerability allows
| unauthenticated attacker with logon to the infrastructure where
| Oracle Java SE executes to compromise Oracle Java SE. Successful
| attacks require human interaction from a person other than the
| attacker. Successful attacks of this vulnerability can result in
| unauthorized creation, deletion or modification access to critical
| data or all Oracle Java SE accessible data. Note: This vulnerability
| can be exploited by using APIs in the specified Component, e.g.,
| through a web service which supplies data to the APIs. This
| vulnerability also applies to Java deployments, typically in clients
| running sandboxed Java Web Start applications or sandboxed Java
| applets, that load and run untrusted code (e.g., code that comes
| from the internet) and rely on the Java sandbox for security. CVSS
| 3.1 Base Score 4.7 (Integrity impacts). CVSS Vector:
| (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N).
CVE-2026-91379[38]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component: JDK
| tools). Supported versions that are affected are Oracle Java SE:
| 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle
| GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise
| Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows
| unauthenticated attacker with logon to the infrastructure where
| Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise
| Edition executes to compromise Oracle Java SE, Oracle GraalVM for
| JDK, Oracle GraalVM Enterprise Edition. Successful attacks require
| human interaction from a person other than the attacker. Successful
| attacks of this vulnerability can result in unauthorized creation,
| deletion or modification access to critical data or all Oracle Java
| SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition
| accessible data. Note: This vulnerability applies to Java
| deployments, typically in clients running sandboxed Java Web Start
| applications or sandboxed Java applets, that load and run untrusted
| code (e.g., code that comes from the internet) and rely on the Java
| sandbox for security. This vulnerability does not apply to Java
| deployments, typically in servers, that load and run only trusted
| code (e.g., code installed by an administrator). CVSS 3.1 Base Score
| 4.7 (Integrity impacts). CVSS Vector:
| (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N).
CVE-2026-91380[39]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| Utility). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;
| Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM
| Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability
| allows unauthenticated attacker with logon to the infrastructure
| where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM
| Enterprise Edition executes to compromise Oracle Java SE, Oracle
| GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful
| attacks of this vulnerability can result in unauthorized update,
| insert or delete access to some of Oracle Java SE, Oracle GraalVM
| for JDK, Oracle GraalVM Enterprise Edition accessible data as well
| as unauthorized read access to a subset of Oracle Java SE, Oracle
| GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
| Note: This vulnerability can be exploited by using APIs in the
| specified Component, e.g., through a web service which supplies data
| to the APIs. This vulnerability also applies to Java deployments,
| typically in clients running sandboxed Java Web Start applications
| or sandboxed Java applets, that load and run untrusted code (e.g.,
| code that comes from the internet) and rely on the Java sandbox for
| security. CVSS 3.1 Base Score 4.0 (Confidentiality and Integrity
| impacts). CVSS Vector:
| (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
CVE-2026-91381[40]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise
| Edition product of Oracle Java SE (component: 2D). Supported
| versions that are affected are Oracle Java SE: 8u503 and
| 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1.
| Difficult to exploit vulnerability allows unauthenticated attacker
| with network access via multiple protocols to compromise Oracle Java
| SE, Oracle GraalVM Enterprise Edition. Successful attacks of this
| vulnerability can result in unauthorized update, insert or delete
| access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition
| accessible data. Note: This vulnerability can be exploited by using
| APIs in the specified Component, e.g., through a web service which
| supplies data to the APIs. This vulnerability also applies to Java
| deployments, typically in clients running sandboxed Java Web Start
| applications or sandboxed Java applets, that load and run untrusted
| code (e.g., code that comes from the internet) and rely on the Java
| sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).
| CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2026-91382[41]:
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition product of Oracle Java SE (component:
| 2D). Supported versions that are affected are Oracle Java SE:
| 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1; Oracle GraalVM for JDK:
| 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition:
| 21.3.19.1.1. Difficult to exploit vulnerability allows
| unauthenticated attacker with network access via multiple protocols
| to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM
| Enterprise Edition. Successful attacks of this vulnerability can
| result in unauthorized creation, deletion or modification access to
| critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle
| GraalVM Enterprise Edition accessible data and unauthorized ability
| to cause a partial denial of service (partial DOS) of Oracle Java
| SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note:
| This vulnerability can be exploited by using APIs in the specified
| Component, e.g., through a web service which supplies data to the
| APIs. This vulnerability also applies to Java deployments, typically
| in clients running sandboxed Java Web Start applications or
| sandboxed Java applets, that load and run untrusted code (e.g., code
| that comes from the internet) and rely on the Java sandbox for
| security. CVSS 3.1 Base Score 6.5 (Integrity and Availability
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L).
https://openjdk.org/groups/vulnerability/advisories/2026-10-21
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-91395
https://www.cve.org/CVERecord?id=CVE-2026-91395
[1] https://security-tracker.debian.org/tracker/CVE-2026-91396
https://www.cve.org/CVERecord?id=CVE-2026-91396
[2] https://security-tracker.debian.org/tracker/CVE-2026-91397
https://www.cve.org/CVERecord?id=CVE-2026-91397
[3] https://security-tracker.debian.org/tracker/CVE-2026-91398
https://www.cve.org/CVERecord?id=CVE-2026-91398
[4] https://security-tracker.debian.org/tracker/CVE-2026-91400
https://www.cve.org/CVERecord?id=CVE-2026-91400
[5] https://security-tracker.debian.org/tracker/CVE-2026-83374
https://www.cve.org/CVERecord?id=CVE-2026-83374
[6] https://security-tracker.debian.org/tracker/CVE-2026-91487
https://www.cve.org/CVERecord?id=CVE-2026-91487
[7] https://security-tracker.debian.org/tracker/CVE-2026-83376
https://www.cve.org/CVERecord?id=CVE-2026-83376
[8] https://security-tracker.debian.org/tracker/CVE-2026-83380
https://www.cve.org/CVERecord?id=CVE-2026-83380
[9] https://security-tracker.debian.org/tracker/CVE-2026-91403
https://www.cve.org/CVERecord?id=CVE-2026-91403
[10] https://security-tracker.debian.org/tracker/CVE-2026-91410
https://www.cve.org/CVERecord?id=CVE-2026-91410
[11] https://security-tracker.debian.org/tracker/CVE-2026-91411
https://www.cve.org/CVERecord?id=CVE-2026-91411
[12] https://security-tracker.debian.org/tracker/CVE-2026-91415
https://www.cve.org/CVERecord?id=CVE-2026-91415
[13] https://security-tracker.debian.org/tracker/CVE-2026-91417
https://www.cve.org/CVERecord?id=CVE-2026-91417
[14] https://security-tracker.debian.org/tracker/CVE-2026-91418
https://www.cve.org/CVERecord?id=CVE-2026-91418
[15] https://security-tracker.debian.org/tracker/CVE-2026-91451
https://www.cve.org/CVERecord?id=CVE-2026-91451
[16] https://security-tracker.debian.org/tracker/CVE-2026-91452
https://www.cve.org/CVERecord?id=CVE-2026-91452
[17] https://security-tracker.debian.org/tracker/CVE-2026-91453
https://www.cve.org/CVERecord?id=CVE-2026-91453
[18] https://security-tracker.debian.org/tracker/CVE-2026-91461
https://www.cve.org/CVERecord?id=CVE-2026-91461
[19] https://security-tracker.debian.org/tracker/CVE-2026-91462
https://www.cve.org/CVERecord?id=CVE-2026-91462
[20] https://security-tracker.debian.org/tracker/CVE-2026-91463
https://www.cve.org/CVERecord?id=CVE-2026-91463
[21] https://security-tracker.debian.org/tracker/CVE-2026-91464
https://www.cve.org/CVERecord?id=CVE-2026-91464
[22] https://security-tracker.debian.org/tracker/CVE-2026-91484
https://www.cve.org/CVERecord?id=CVE-2026-91484
[23] https://security-tracker.debian.org/tracker/CVE-2026-83381
https://www.cve.org/CVERecord?id=CVE-2026-83381
[24] https://security-tracker.debian.org/tracker/CVE-2026-83387
https://www.cve.org/CVERecord?id=CVE-2026-83387
[25] https://security-tracker.debian.org/tracker/CVE-2026-83395
https://www.cve.org/CVERecord?id=CVE-2026-83395
[26] https://security-tracker.debian.org/tracker/CVE-2026-83400
https://www.cve.org/CVERecord?id=CVE-2026-83400
[27] https://security-tracker.debian.org/tracker/CVE-2026-87290
https://www.cve.org/CVERecord?id=CVE-2026-87290
[28] https://security-tracker.debian.org/tracker/CVE-2026-87292
https://www.cve.org/CVERecord?id=CVE-2026-87292
[29] https://security-tracker.debian.org/tracker/CVE-2026-87293
https://www.cve.org/CVERecord?id=CVE-2026-87293
[30] https://security-tracker.debian.org/tracker/CVE-2026-87294
https://www.cve.org/CVERecord?id=CVE-2026-87294
[31] https://security-tracker.debian.org/tracker/CVE-2026-87367
https://www.cve.org/CVERecord?id=CVE-2026-87367
[32] https://security-tracker.debian.org/tracker/CVE-2026-91332
https://www.cve.org/CVERecord?id=CVE-2026-91332
[33] https://security-tracker.debian.org/tracker/CVE-2026-91334
https://www.cve.org/CVERecord?id=CVE-2026-91334
[34] https://security-tracker.debian.org/tracker/CVE-2026-91335
https://www.cve.org/CVERecord?id=CVE-2026-91335
[35] https://security-tracker.debian.org/tracker/CVE-2026-91373
https://www.cve.org/CVERecord?id=CVE-2026-91373
[36] https://security-tracker.debian.org/tracker/CVE-2026-91374
https://www.cve.org/CVERecord?id=CVE-2026-91374
[37] https://security-tracker.debian.org/tracker/CVE-2026-91375
https://www.cve.org/CVERecord?id=CVE-2026-91375
[38] https://security-tracker.debian.org/tracker/CVE-2026-91379
https://www.cve.org/CVERecord?id=CVE-2026-91379
[39] https://security-tracker.debian.org/tracker/CVE-2026-91380
https://www.cve.org/CVERecord?id=CVE-2026-91380
[40] https://security-tracker.debian.org/tracker/CVE-2026-91381
https://www.cve.org/CVERecord?id=CVE-2026-91381
[41] https://security-tracker.debian.org/tracker/CVE-2026-91382
https://www.cve.org/CVERecord?id=CVE-2026-91382
Please adjust the affected versions in the BTS as needed.