Not sure what you meant, but almost all recent security holes were client-side. As far as I remember, server-side Java has been fairly robust.