Skip to content
Sign in

Oracle product

Java SE

Alert
No CISA KEV deadline is open. CISA last added a Java SE CVE on 28 Mar 2022.

Tracked since 22 Oct · latest article 31 Oct · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 7 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

1Articles · 7 days

usual rate

Exploited, by due date7

Java SE CVEs in CISA KEV with their federal deadlines. None is open.

Exploited Java SE CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2012-5076Java SE28 MarPassed 18 Apr–
In CISA KEVCVE-2013-2465RansomwareJava SE28 MarPassed 18 Apr–
In CISA KEVCVE-2012-0507RansomwareJava SE3 MarPassed 24 Mar–
In CISA KEVCVE-2012-1723RansomwareJava SE3 MarPassed 24 Mar–
In CISA KEVCVE-2012-4681RansomwareJava SE3 MarPassed 24 Mar–
In CISA KEVCVE-2015-2590Java SE3 MarPassed 24 Mar–
Show 1 moreVendor CSV of 46 entries for OracleAll 46 vendor entries, including other products.

Patch cadence and exploit odds

How often CISA adds Java SE CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’250Q3 ’250Q4 ’250Q1 ’260Q2 ’260Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20260
Q3 20260
Q4 20260

No additions in the last eight quarters.

Fix listed

2 of 2 CVEs in coverage

Every CVE in coverage has a fix recorded.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-91403: 31.4th percentileCVE-2026-114820: 16.9th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-9140331.4
CVE-2026-11482016.9

Coverage3 articles · all time

The latest 3 articles naming Java SE, in the shared story grammar.

Full timeline
Developinglatest 3 hours ago3 articles2 outlets

3 articles from 2 outlets since 22 Oct. Picked up again today after 8 days quiet.

Now22 Oct23First reportSecurityWeek · 22 Oct, 08:01Picked up againafter 8 days quiet
  • Thu 22 Oct, 08:01 UTC. SecurityWeek, first report. Oracle fixes 1,209 vulnerabilities in October security update.
  • Fri 23 Oct, 04:30 UTC. SecurityOnline, its first report on the story. Oracle Rushes Fix for Compromised Certificates Threatening Java Users.
  • Sat 31 Oct, 10:30 UTC. SecurityOnline. JetBrains patches IDE flaws linked to eMudhra certificate breach.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 3 articles as a list
  1. Thu 22 OctDay 01
    1. Oracle fixes 1,209 vulnerabilities in October security update08:01 · SecurityWeek · First report
  2. Fri 23 OctDay 11
    1. Oracle Rushes Fix for Compromised Certificates Threatening Java Users04:30 · SecurityOnline

  3. Quiet for 8 days

    Sat 31 OctDay 91
    1. JetBrains patches IDE flaws linked to eMudhra certificate breach10:30 · SecurityOnline · Picked up again

All CVEs in coverage2

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-91403

    Oracle Corporation Oracle Java SE vulnerability

    9.1Critical0.4% EPSS · 3 articles
  • CVE-2026-114820

    Oracle Corporation Oracle Java SE vulnerability

    9.1Critical0.3% EPSS · 0 articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in