# Oracle Graalvm


- [CVE-2023-41993](https://insights.sbomify.com/CVE-2023-41993/): Apple Multiple Products WebKit Code Execution (high 8.8, exploited in the wild)
- [CVE-2021-22931](https://insights.sbomify.com/CVE-2021-22931/): Code injection in Node (critical 9.8)
- [CVE-2021-29921](https://insights.sbomify.com/CVE-2021-29921/): Security feature bypass in n/a (critical 9.8)
- [CVE-2019-15605](https://insights.sbomify.com/CVE-2019-15605/): Other in Node (critical 9.8)
- [CVE-2019-15606](https://insights.sbomify.com/CVE-2019-15606/): Auth bypass in Node (critical 9.8)
- [CVE-2019-17560](https://insights.sbomify.com/CVE-2019-17560/): Improper Certificate Validation in Apache Netbeans (critical 9.1)
- [CVE-2025-50059](https://insights.sbomify.com/CVE-2025-50059/): Security feature bypass in Oracle GraalVM Enterprise Edition (high 8.6)
- [CVE-2021-37701](https://insights.sbomify.com/CVE-2021-37701/): Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links (high 8.2)
- [CVE-2021-37712](https://insights.sbomify.com/CVE-2021-37712/): Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links (high 8.2)
- [CVE-2021-37713](https://insights.sbomify.com/CVE-2021-37713/): Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization (high 8.2)
- [CVE-2021-39134](https://insights.sbomify.com/CVE-2021-39134/): UNIX Symbolic Link (Symlink) Following in @npmcli/arborist (high 8.2)
- [CVE-2021-39135](https://insights.sbomify.com/CVE-2021-39135/): UNIX Symbolic Link (Symlink) Following in @npmcli/arborist (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/products/oracle/graalvm/