[robert-wallis]

Here's a list of Java CVEs: https://www.cvedetails.com/vulnerability-list/vendor_id-93/p...

To be clear, I am not a security researcher, and I haven't verified the severity of these issues. But in 2016 alone there are 16 CVEs which is 4 per month.

[lmm]

Those are vulnerabilities in the JVM itself - and I'd bet a fair bit the majority will be in the C/C++ parts, not the Java parts.