{
 "arch": "arm64",
 "findings": [
  {
   "affects": [
    "openjdk-17"
   ],
   "cvss": 7.5,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-47057",
   "severity": "high",
   "title": "Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31.",
   "url": "https://ubuntu.com/security/CVE-2026-47057"
  },
  {
   "affects": [
    "openjdk-17"
   ],
   "cvss": 7.5,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-47063",
   "severity": "high",
   "title": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).",
   "url": "https://ubuntu.com/security/CVE-2026-47063"
  },
  {
   "affects": [
    "openjdk-17"
   ],
   "cvss": 7.5,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-70906",
   "severity": "high",
   "title": "Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2.",
   "url": "https://ubuntu.com/security/CVE-2026-70906"
  },
  {
   "affects": [
    "openjdk-17"
   ],
   "cvss": 7.4,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-47058",
   "severity": "high",
   "title": "Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31.",
   "url": "https://ubuntu.com/security/CVE-2026-47058"
  },
  {
   "affects": [
    "openjdk-17"
   ],
   "cvss": 6.8,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-61308",
   "severity": "medium",
   "title": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).",
   "url": "https://ubuntu.com/security/CVE-2026-61308"
  },
  {
   "affects": [
    "openjdk-17"
   ],
   "cvss": 6.5,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-60147",
   "severity": "medium",
   "title": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).",
   "url": "https://ubuntu.com/security/CVE-2026-60147"
  },
  {
   "affects": [
    "openjdk-17"
   ],
   "cvss": 5.9,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-46968",
   "severity": "medium",
   "title": "Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM\u2026",
   "url": "https://ubuntu.com/security/CVE-2026-46968"
  },
  {
   "affects": [
    "openjdk-17"
   ],
   "cvss": 5.3,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-46917",
   "severity": "medium",
   "title": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).",
   "url": "https://ubuntu.com/security/CVE-2026-46917"
  },
  {
   "affects": [
    "openjdk-17"
   ],
   "cvss": 5.3,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-47021",
   "severity": "medium",
   "title": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).",
   "url": "https://ubuntu.com/security/CVE-2026-47021"
  },
  {
   "affects": [
    "openjdk-17"
   ],
   "cvss": 5.3,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-47027",
   "severity": "medium",
   "title": "Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM\u2026",
   "url": "https://ubuntu.com/security/CVE-2026-47027"
  },
  {
   "affects": [
    "openjdk-17"
   ],
   "cvss": 5.3,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-70907",
   "severity": "medium",
   "title": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).",
   "url": "https://ubuntu.com/security/CVE-2026-70907"
  },
  {
   "affects": [
    "openjdk-17"
   ],
   "cvss": 3.7,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-47010",
   "severity": "low",
   "title": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).",
   "url": "https://ubuntu.com/security/CVE-2026-47010"
  },
  {
   "affects": [
    "openjdk-17"
   ],
   "cvss": 3.7,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-47059",
   "severity": "low",
   "title": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).",
   "url": "https://ubuntu.com/security/CVE-2026-47059"
  },
  {
   "affects": [
    "openjdk-17"
   ],
   "cvss": 3.7,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-60589",
   "severity": "low",
   "title": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).",
   "url": "https://ubuntu.com/security/CVE-2026-60589"
  }
 ],
 "findings_changed_at": "2026-08-27T13:07:31Z",
 "image": "openjdk",
 "inputs": {
  "sbom_sha256": "952d165730888e4c447229d8d0c36c2482d7926d9d0cf1fdaf8f116941ad52d7"
 },
 "platform_digest": "sha256:c3b899612537abdc94dcb7c68826f13e2bb78018d14084dce93b91d277721618",
 "project": "openjdk",
 "receipt_sha256": "524bb21ebcc77708431598847f3874e7312f4327364b050f170f7e183956e6ef",
 "scanner": "grype",
 "severity_counts": {
  "critical": 0,
  "high": 4,
  "low": 3,
  "medium": 7,
  "unknown": 0
 },
 "suppressed": [
  {
   "affects": [
    "zlib"
   ],
   "by": "vex",
   "id": "CVE-2026-27171"
  }
 ],
 "version": "17.0.20",
 "vex_applied": [
  "openjdk-17.0.20-arm64.vex.json",
  "openjdk-17.0.20-arm64.ubuntu-vex.json"
 ]
}