Login Request a demo
GR
Product
Graalvm
by Oracle · last CVE Jul 21, 2026
On CISA KEVExploited in the wild
196
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities196In the news0Timeline
Severity mix
Critical 6High 57Medium 86Low 47
Severity
All severities196Critical6High57Medium86Low47
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Graalvm to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-35567
6.8
3%
Oct 20
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)
Affected: 20.3.3; 21.2.0
CVE-2019-2989
6.8
3%
Oct 16
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking)
Affected: 19.2.0
CVE-2019-2862
6.8
1%
Jul 23
Vulnerability in the Oracle GraalVM Enterprise Edition component of Oracle GraalVM (subcomponent: Java)
Affected: 19.0.0
CVE-2026-60147
6.5
0%
Jul 21
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)
Affected: 21.3.18
CVE-2021-22959
6.5
3%
Nov 15
The parser in accepts requests with a space (SP) right after the header name before the colon
Affected: 20.3.4; 21.3.0
CVE-2021-22960
6.5
2%
Nov 3
The parse function in llhttp < 2.1.4 and < 6.0.6
Affected: 20.3.4; 21.3.0
CVE-2020-8287
6.5
16%
Jan 6
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields)
Affected: 19.3.4; 20.3.0
CVE-2019-16777
6.5
2%
Dec 13
Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite
Affected: 19.3.0.2
CVE-2019-16775
6.5
3%
Dec 13
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write
Affected: 19.3.0.2; 20.3.3; 21.2.2
CVE-2019-9516
6.5
56%
Aug 13
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service
Affected: 19.2.0
CVE-2020-2799
6.3
1%
Apr 15
Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: GraalVM Compiler)
Affected: 19.3.1; 20.0.0
CVE-2026-21933
6.1
0%
Jan 20
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking)
Affected: 21.3.16
CVE-2026-22003
6.0
0%
Apr 21
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)
Affected: 21.3.17
CVE-2026-46968
5.9
0%
Jul 21
Vulnerability in Oracle Java SE (component: JSSE)
Affected: 21.3.18
CVE-2025-53057
5.9
1%
Oct 21
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)
Affected: 21.3.15
CVE-2025-30761
5.9
5%
Jul 15
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting)
Affected: 21.3.14
CVE-2024-20921
5.9
1%
Feb 17
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)
Affected: 20.3.12; 21.3.8; 22.3.4
CVE-2024-20919
5.9
1%
Feb 17
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)
Affected: 20.3.12; 21.3.8; 22.3.4
CVE-2024-20926
5.9
1%
Jan 16
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting)
Affected: 20.3.12; 21.3.8; 22.3.4
CVE-2023-21967
5.9
2%
Apr 18
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)
Affected: 20.3.9; 21.3.5; 22.3.1
CVE-2023-21954
5.9
1%
Apr 18
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)
Affected: 20.3.9; 21.3.5; 22.3.1
CVE-2022-21541
5.9
3%
Jul 19
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)
Affected: 20.3.6; 21.3.2; 22.1.0
CVE-2021-35550
5.9
7%
Oct 20
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)
Affected: 20.3.3; 21.2.0
CVE-2021-2161
5.9
3%
Apr 22
Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)
Affected: 19.3.5; 20.3.1.2; 21.0.0.2
CVE-2021-3449
5.9
64%
Mar 25
NULL pointer deref in signature_algorithms processing
Affected: 19.3.5; 20.3.1.2; 21.0.0.2
CVE-2021-23841
5.9
7%
Feb 16
The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509…
Affected: 19.3.5; 20.3.1.2; 21.0.0.2
CVE-2020-1971
5.9
7%
Dec 8
The X.509 GeneralName type is a generic type for representing different types of names
Affected: 19.3.4; 20.3.0
CVE-2020-2595
5.8
1%
Jan 15
Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: GraalVM Compiler)
Affected: 19.3.0.2
CVE-2023-21986
5.7
0%
Apr 18
Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Native Image)
Affected: 20.3.9; 21.3.5; 22.3.1
CVE-2025-30698
5.6
1%
Apr 15
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D)
Affected: 20.3.17; 21.3.13
CVE-2020-28928
5.5
1%
Nov 24
In musl libc through 1.2.1, wcsnrtombs mishandles particular combinations of destination buffer size and source character limit, as demonstrated by an invalid write access (buffer…
Affected: 20.3.2; 21.1.0
CVE-2026-47027
5.3
0%
Jul 21
Vulnerability in Oracle Java SE (component: Libraries)
Affected: 21.3.18
CVE-2026-47021
5.3
0%
Jul 21
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D)
Affected: 21.3.18
CVE-2026-46917
5.3
0%
Jul 21
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)
Affected: 21.3.18
CVE-2026-22021
5.3
0%
Apr 21
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)
Affected: 21.3.17
CVE-2026-22013
5.3
0%
Apr 21
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS)
Affected: 21.3.17
CVE-2023-21939
5.3
2%
Apr 18
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing)
Affected: 20.3.9; 21.3.5; 22.3.1
CVE-2023-21835
5.3
2%
Jan 18
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)
Affected: 20.3.8; 21.3.4; 22.3.0
CVE-2023-21830
5.3
1%
Jan 18
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization)
Affected: 20.3.8; 21.3.4; 22.3.0
CVE-2022-21628
5.3
3%
Oct 18
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server)
Affected: 20.3.7; 21.3.3; 22.2.0
CVE-2022-21597
5.3
1%
Oct 18
Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaScript)
Affected: 20.3.7; 21.3.3; 22.2.0
CVE-2022-21618
5.3
3%
Oct 18
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS)
Affected: 21.3.3; 22.2.0
CVE-2022-21626
5.3
2%
Oct 18
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)
Affected: 20.3.7; 21.3.3; 22.2.0
CVE-2022-21549
5.3
3%
Jul 19
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)
Affected: 21.3.2; 22.1.0
CVE-2022-21540
5.3
4%
Jul 19
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)
Affected: 20.3.6; 21.3.2; 22.1.0
CVE-2022-21496
5.3
3%
Apr 19
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI)
Affected: 20.3.5; 21.3.1; 22.0.0.2
CVE-2022-21434
5.3
2%
Apr 19
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)
Affected: 20.3.5; 21.3.1; 22.0.0.2
CVE-2022-21426
5.3
3%
Apr 19
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP)
Affected: 20.3.5; 21.3.1; 22.0.0.2
CVE-2021-44532
5.3
10%
Feb 24
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format
Affected: 20.3.5; 21.3.1; 22.0.0.2
CVE-2021-44533
5.3
9%
Feb 24
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly
Affected: 20.3.5; 21.3.1; 22.0.0.2
Page 1 of 2 · 86 total
12