VulnRadar

Data against noise.

Page generated: 08 Nov 2026, 08:00 UTC

CVE-2013-2465

Read full description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.

CVSS 9.8 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

9.0/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 9.8: +1.47
Fresh EPSS: 98.77%: +0.49

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 8 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

TechTarget

Press · 01 Mar 2021, 08:00 · 3 ransomware distribution methods popular with attackers - TechTarget

Recorded Future

Press · 10 Dec 2014, 08:00 · Tracking Moving Targets: Exploit Kits and CVEs - Recorded Future

Check Point Blog

Press · 11 Aug 2014, 07:00 · Check Point Protects from the HAVEX Malware Targeting ICS/SCADA Systems - Check Point Blog

Malwarebytes

Press · 29 Jul 2014, 07:00 · SocialBlade.com compromised, starts redirection chain to Nuclear Pack exploit kit - Malwarebytes

Security Affairs

Press · 24 Jun 2014, 07:00 · Top website Askmen hacked and used to serve a banking trojan - Security Affairs

See all 8 source documents

Cisco Talos Blog

Press · 02 May 2014, 07:00 · Continued analysis of the LightsOut Exploit Kit - Cisco Talos Blog

Securelist

Press · 28 Jan 2014, 08:00 · A Cross-platform Java-bot - Securelist

Securelist

Press · 05 Dec 2013, 08:00 · Kaspersky Security Bulletin 2013. Corporate threats - Securelist

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 9.0 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Source entries and unverified repository candidates are counted separately.

Public exploit evidence

exploitdb #27705 2013-08-19

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 9.8; EPSS 98.8%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:57:32.543775+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Published

18 Jun 2013, 22:00

First press mention

05 Dec 2013, 08:00

Latest press mention

01 Mar 2021, 08:00

Added to the CISA KEV catalog

28 Mar 2022, 00:00

Score calculated

05 Nov 2026, 13:57

PoCs on GitHub

1 repositories