GR
Product
Graalvm
On CISA KEVExploited in the wild
196
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 57Medium 86Low 47
Watch
Add Graalvm to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-41993 In wildKEV | 8.8 | Sep 21 | Apple Multiple Products WebKit Code Execution Vulnerability Affected: 20.3.13; 21.3.9 |
| CVE-2021-22931 | 9.8 | Aug 16 | Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name… Affected: 20.3.3; 21.2.0 |
| CVE-2021-29921 | 9.8 | May 6 | In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string Affected: 20.3.2; 21.1.0 |
| CVE-2020-7774 | 9.8 | Nov 17 | The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution Affected: 19.3.5; 20.3.1.2; 21.0.0.2 |
| CVE-2019-15606 | 9.8 | Feb 7 | Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons Affected: 19.3.1; 20.0.0 |
| CVE-2019-15605 | 9.8 | Feb 7 | HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed Affected: 19.3.1; 20.0.0 |
| CVE-2019-17560 | 9.1 | Mar 30 | The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads Affected: 19.3.2; 20.1.0 |
| CVE-2025-50059 | 8.6 | Jul 15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking) Affected: 21.3.14 |
| CVE-2021-37713 | 8.6 | Aug 31 | The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability Affected: 20.3.3; 21.2.0 |
| CVE-2021-37712 | 8.6 | Aug 31 | The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability Affected: 20.3.3; 21.2.0 |
| CVE-2021-37701 | 8.6 | Aug 31 | The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability Affected: 20.3.3; 21.2.0 |
| CVE-2021-21349 | 8.6 | Mar 22 | A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host Affected: 20.3.4; 21.3.0 |
| CVE-2025-50106 | 8.1 | Jul 15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D) Affected: 21.3.14 |
| CVE-2025-30749 | 8.1 | Jul 15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D) Affected: 21.3.14 |
| CVE-2021-32804 | 8.1 | Aug 3 | The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path… Affected: 20.3.3; 21.2.0 |
| CVE-2021-32803 | 8.1 | Aug 3 | The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection Affected: 20.3.3; 21.2.0 |
| CVE-2020-8265 | 8.1 | Jan 6 | Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation Affected: 19.3.4; 20.3.0 |
| CVE-2020-2604 | 8.1 | Jan 15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization) Affected: 19.3.0.2 |
| CVE-2019-16776 | 8.1 | Dec 13 | Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write Affected: 19.3.0.2 |
| CVE-2019-16255 | 8.1 | Nov 26 | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb… Affected: 19.3.0.2 |
| CVE-2026-62574 | 7.8 | Jul 21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install) Affected: 21.3.18 |
| CVE-2021-39135 | 7.8 | Aug 31 | `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package… Affected: 20.3.3; 21.2.0 |
| CVE-2021-39134 | 7.8 | Aug 31 | `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package… Affected: 20.3.3; 21.2.0 |
| CVE-2020-2802 | 7.7 | Apr 15 | Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: GraalVM Compiler) Affected: 19.3.1; 20.0.0 |
| CVE-2019-2986 | 7.7 | Oct 16 | Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: LLVM Interpreter) Affected: 19.2.0 |
| CVE-2019-2813 | 7.7 | Jul 23 | Vulnerability in the Oracle GraalVM Enterprise Edition component of Oracle GraalVM (subcomponent: GraalVM) Affected: 19.0.0 |
| CVE-2026-47063 | 7.5 | Jul 21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries) Affected: 21.3.18 |
| CVE-2026-34282 | 7.5 | Apr 21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking) Affected: 21.3.17 |
| CVE-2026-22016 | 7.5 | Apr 21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP) Affected: 21.3.17 |
| CVE-2026-21945 | 7.5 | Jan 20 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security) Affected: 21.3.16 |
| CVE-2025-53066 | 7.5 | Oct 21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP) Affected: 21.3.15 |
| CVE-2024-20932 | 7.5 | Jan 16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security) Affected: 21.3.8; 22.3.4 |
| CVE-2022-21634 | 7.5 | Oct 18 | Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: LLVM Interpreter) Affected: 20.3.7; 21.3.3; 22.2.0 |
| CVE-2022-34169 | 7.5 | Jul 19 | The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets Affected: 20.3.6; 21.3.2; 22.1.0 |
| CVE-2022-25647 | 7.5 | May 1 | The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS… Affected: 20.3.6; 21.3.2; 22.1.0 |
| CVE-2022-21476 | 7.5 | Apr 19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries) Affected: 20.3.5; 21.3.1; 22.0.0.2 |
| CVE-2022-21449 | 7.5 | Apr 19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries) Affected: 21.3.1; 22.0.0.2 |
| CVE-2021-22940 | 7.5 | Aug 16 | Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior Affected: 20.3.3; 21.2.0 |
| CVE-2021-2388 | 7.5 | Jul 21 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot) Affected: 20.3.2; 21.1.0 |
| CVE-2021-27290 | 7.5 | Mar 12 | ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service Affected: 20.3.3; 21.2.0 |
| CVE-2021-22884 | 7.5 | Mar 3 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6” Affected: 19.3.5; 20.3.1.2; 21.0.0.2 |
| CVE-2021-22883 | 7.5 | Mar 3 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established Affected: 19.3.5; 20.3.1.2; 21.0.0.2 |
| CVE-2021-23840 | 7.5 | Feb 16 | Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable… Affected: 19.3.5; 20.3.1.2; 21.0.0.2 |
| CVE-2020-8277 | 7.5 | Nov 19 | A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1… Affected: 19.3.4; 20.3.0 |
| CVE-2020-11080 | 7.5 | Jun 3 | In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service Affected: 19.3.2; 20.1.0 |
| CVE-2019-17561 | 7.5 | Mar 30 | The "Apache NetBeans" autoupdate system does not fully validate code signatures Affected: 19.3.2; 20.1.0 |
| CVE-2019-15604 | 7.5 | Feb 7 | Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate Affected: 19.3.1; 20.0.0 |
| CVE-2019-9518 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service Affected: 19.2.0 |
| CVE-2019-9517 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service Affected: 19.2.0 |
| CVE-2019-9515 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service Affected: 19.2.0 |