https://adtmag.com/articles/2020/01/14/oracle-java-patch-2020.aspx

Oracle's first Critical Patch Update (CPU) of 2020, due this week, will include only 12 new security patches for Java Standard Edition (Java SE), just over half the patches published in October 2019. This CPU addresses 333 total new security vulnerabilities in Oracle's products.

Oracle listed the versions affected by the vulnerabilities in a pre-release announcement. All 12 may be remotely exploitable without authentication, which means they may be exploited over a network without requiring user credentials.