Yes there are Java exploits and a fair number of 'zero day' ones over
the years, same as Flash, Adobe Reader and Windows itself. The issue
with any security is keeping your systems up to date and being wary
what you click on ( plus read what you are clicking to allow !! ).

Sad fact is there are enough users around who aren't careful and will
happily click on anything to 'get rid of that annoying pop-up' :-(

It is possible to use the internet without Java and Flash etc but it's
going to be a frustrating experience in the main as many web sites
need these add-ons to function properly. As HTML5 gains ground we'll
be seeing less need for Java / Flash / Silverlight etc so eventually
they won't be needed but it's going to be a while before we can say
bye-bye to them for good

However - don't for one minute think this will mean we can relax out
guard. No doubt the malware writers will be hard at work cooking up
exploits for HTML5 too