339
CVEs
72
Critical
51
High
2
KEV
22
PoC
99
Unpatched C/H
36.9%
Patch Rate
5.1%
Avg EPSS
Severity Breakdown
CRITICAL
72
HIGH
51
MEDIUM
168
LOW
48
Monthly CVE Trend
Affected Products (30)
Java
172
Jre
170
Jdk
159
Sunos
145
Opensolaris
16
Javafx
14
Wireshark
14
Keymouse Firmware
9
Gs1900 10Hp Firmware
9
Jrockit
9
X14J Firmware
8
Opensuse
8
Ehrd
6
Jr6150 Firmware
4
Ios Xe
4
Enterprise Linux
4
Freeflow Print Server
3
Linux Enterprise Software Development Kit
2
Nx Os
2
Evolved Programmable Network Manager
2
Thinkcentre E75S Firmware
2
Linux Enterprise Desktop
2
Linux Enterprise Server
2
Glassfish Server
2
Prime Infrastructure
2
Linux Enterprise Java
2
Windows Xp
1
Debian Linux
1
Core I5 9400F Firmware
1
Windows Server 2008
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2013-2465 | Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthenticated attackers to execute arbitrary code and escape security restrictions. Affects Oracle JRE 5.0 through Update 45, 6 through Update 45, 7 through Update 21, and OpenJDK 7. Confirmed actively exploited (CISA KEV) with 93.22% EPSS probability and publicly available exploit code. Oracle released patches in June 2013 CPU addressing the vulnerability through image channel verification corrections. | CRITICAL | 9.8 | 93.2% | 237 |
KEV
PoC
|
| CVE-2012-0507 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available. | CRITICAL | 9.8 | 93.6% | 228 |
KEV
PoC
No patch
|
| CVE-2013-1493 | The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.0%. | CRITICAL | 10.0 | 93.0% | 178 |
PoC
No patch
|
| CVE-2012-0500 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 74.9%. | CRITICAL | 10.0 | 74.9% | 160 |
PoC
No patch
|
| CVE-2012-0217 | The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 88.0%. | HIGH | 7.2 | 88.0% | 159 |
PoC
No patch
|
| CVE-2012-1533 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 65.9%. | CRITICAL | 10.0 | 65.9% | 151 |
PoC
|
| CVE-2013-2470 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 54.4%. | CRITICAL | 10.0 | 54.4% | 124 |
PoC
No patch
|
| CVE-2013-2472 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 54.4%. | CRITICAL | 10.0 | 54.4% | 124 |
PoC
No patch
|
| CVE-2012-5081 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 73.5%. | MEDIUM | 5.0 | 73.5% | 118 |
PoC
|
| CVE-2013-2461 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier; the Oracle JRockit component in Oracle Fusion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 70.9% and no vendor patch available. | HIGH | 7.5 | 70.9% | 108 |
No patch
|
| CVE-2013-2463 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 44.7% and no vendor patch available. | CRITICAL | 10.0 | 44.7% | 95 |
No patch
|
| CVE-2013-2471 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 40.1% and no vendor patch available. | CRITICAL | 10.0 | 40.1% | 90 |
No patch
|
| CVE-2013-2473 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 30.9% and no vendor patch available. | CRITICAL | 10.0 | 30.9% | 81 |
No patch
|
| CVE-2012-0551 | Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE 7 update 4 and earlier and 6 update 32 and earlier, and the GlassFish Enterprise Server component in Oracle Sun. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 29.1%. | MEDIUM | 5.8 | 29.1% | 78 |
PoC
No patch
|
| CVE-2013-2469 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 27.3% and no vendor patch available. | CRITICAL | 10.0 | 27.3% | 77 |
No patch
|