Many of the Java security bugs are in Java code. Relevant to this discussion, "Jetbleed". The many other SSL breaks in Java. A variety of issues involving deserialization of untrusted data, ala Rails yaml bug. Bugs in the JVM itself are more the exception than the rule.