When looking at the Oracle Java JRE vulnerability list on cvedetails, they list the affected versions in the text, and usually also in a table below the description. However, I'm not confident that the vulnerability is only confined to the listed versions. The following is stated for CVE-2019-2816 (https://www.cvedetails.com/cve/CVE-2019-2816/):
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211.
Underneath is a table listing the affected versions, including JRE version 1.8 (Java 8) update 211 and 212. But also Java 7 update 221. So my guess would be that it's included in previous Java 8 updates as well. We're currently using Java 8 update 162. On the other hand, it could've been in a fix that was included in Java 8 and Java 7, in later versions.
While the table with all the affected versions is very detailed for some libraries on that website, I know that they're not always filled properly. A counter example is a vulnerability saying "anything up to this version is affected", but only listing the previous version as the sole content of the table with affected versions.
Is there a better site, which I just haven't discovered, that is more clear about this? Or can I trust, that the latest Java vulnerabilities won't affect us, due to using the older version? My current guess would that only the latest versions have been tested by the security researchers.