H2
Vendor
h2oai
32
CVEs
0
On KEV
0
New 30D
Products
H29.8
h2oai/h2o-3
h2oai
23 CVEs0 on KEV0 new
H29.8
h2o-3
h2oai
8 CVEs0 on KEV0 new
H29.8
h2ogpt
h2oai
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-65700 | H2 h2ogpt h2oai | 9.8 | Jul 23 | h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API |
| CVE-2026-8752 | H2 h2o-3 h2oai | 5.3 | May 17 | h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control |
| CVE-2026-8751 | H2 h2o-3 h2oai | 9.8 | May 17 | h2oai h2o-3 JAR Model.java importBinaryModel deserialization |
| CVE-2026-8750 | H2 h2o-3 h2oai | 7.5 | May 17 | h2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure |
| CVE-2026-3960 | H2 h2oai/h2o-3 h2oai | 9.8 | Apr 23 | Remote Code Execution in h2oai/h2o-3 |
| CVE-2024-5986 | H2 h2oai/h2o-3 h2oai | 9.1 | Feb 2 | Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3 |
| CVE-2025-10769 | H2 h2o-3 h2oai | 9.8 | Sep 21 | h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization |
| CVE-2025-10768 | H2 h2o-3 h2oai | 9.8 | Sep 21 | h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization |
| CVE-2025-6544 | H2 h2oai/h2o-3 h2oai | 9.8 | Sep 21 | Deserialization Vulnerability in h2oai/h2o-3 |
| CVE-2025-5662 | H2 h2oai/h2o-3 h2oai | 9.8 | Sep 2 | Deserialization Vulnerability in h2oai/h2o-3 |
| CVE-2025-6507 | H2 h2oai/h2o-3 h2oai | 9.8 | Sep 1 | Deserialization of Untrusted Data in h2oai/h2o-3 |
| CVE-2024-10549 | H2 h2oai/h2o-3 h2oai | 7.5 | Mar 20 | Denial of Service by ReDOS in h2oai/h2o-3 |
| CVE-2024-8062 | H2 h2oai/h2o-3 h2oai | 7.5 | Mar 20 | Denial of Service in h2oai/h2o-3 |
| CVE-2024-7768 | H2 h2oai/h2o-3 h2oai | 7.5 | Mar 20 | Denial of Service in h2oai/h2o-3 |
| CVE-2024-6863 | H2 h2oai/h2o-3 h2oai | 6.5 | Mar 20 | Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3 |
| CVE-2024-8616 | H2 h2oai/h2o-3 h2oai | 8.2 | Mar 20 | Arbitrary File Overwrite in h2oai/h2o-3 |
| CVE-2024-10550 | H2 h2oai/h2o-3 h2oai | 7.5 | Mar 20 | Denial of Service by ReDOS in h2oai/h2o-3 |
| CVE-2024-6854 | H2 h2oai/h2o-3 h2oai | 7.1 | Mar 20 | Arbitrary File Overwrite in h2oai/h2o-3 |
| CVE-2024-10572 | H2 h2oai/h2o-3 h2oai | 7.5 | Mar 20 | Denial of Service and Arbitrary File Write in h2oai/h2o-3 |
| CVE-2024-10553 | H2 h2oai/h2o-3 h2oai | 9.8 | Mar 20 | Jdbc Deserialization in h2oai/h2o-3 |
| CVE-2024-7765 | H2 h2oai/h2o-3 h2oai | 7.5 | Mar 20 | Denial of Service in h2oai/h2o-3 |
| CVE-2024-8862 | H2 h2o-3 h2oai | 9.8 | Sep 14 | h2oai h2o-3 JDBC Connection 1 getConnectionSafe deserialization |
| CVE-2024-45758 | H2 H2o-3 H2oai | 9.1 | Sep 6 | H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution |
| CVE-2024-5979 | H2 h2oai/h2o-3 h2oai | 7.5 | Jun 27 | Denial of Service via Invalid Argument in h2oai/h2o-3 |
| CVE-2024-5550 | H2 h2oai/h2o-3 h2oai | 5.3 | Jun 6 | Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3 |
| CVE-2024-1456 | H2 h2oai/h2o-3 h2oai | 7.1 | Apr 16 | S3 Bucket Takeover in h2oai/h2o-3 |
| CVE-2023-6569 | H2 h2oai/h2o-3 h2oai | 8.2 | Dec 14 | External Control of File Name or Path in h2oai/h2o-3 |
| CVE-2023-6013 | H2 h2oai/h2o-3 h2oai | 5.4 | Nov 16 | H2O Local File Include |
| CVE-2023-6017 | H2 h2oai/h2o-3 h2oai | 7.1 | Nov 16 | H2O S3 Bucket Takeover |
| CVE-2023-6038 | H2 h2oai/h2o-3 h2oai | 7.5 | Nov 16 | Local File Inclusion in h2oai/h2o-3 |
| CVE-2023-6016 | H2 h2oai/h2o-3 h2oai | 9.8 | Nov 16 | H2O Remote Code Execution via POJO Model Import |