H2
Vendor
h2oai
12
CVEs
0
On KEV
0
New 30D
Products
H29.8
h2o-3
h2oai
6 CVEs0 on KEV0 new
H29.8
h2oai/h2o-3
h2oai
5 CVEs0 on KEV0 new
H29.8
h2ogpt
h2oai
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-65700 | H2 h2ogpt h2oai | 9.8 | Jul 23 | h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API |
| CVE-2026-8752 | H2 h2o-3 h2oai | 5.3 | May 17 | h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control |
| CVE-2026-8751 | H2 h2o-3 h2oai | 9.8 | May 17 | h2oai h2o-3 JAR Model.java importBinaryModel deserialization |
| CVE-2026-8750 | H2 h2o-3 h2oai | 7.5 | May 17 | h2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure |
| CVE-2026-3960 | H2 h2oai/h2o-3 h2oai | 9.8 | Apr 23 | Remote Code Execution in h2oai/h2o-3 |
| CVE-2024-5986 | H2 h2oai/h2o-3 h2oai | 9.1 | Feb 2 | Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3 |
| CVE-2025-10769 | H2 h2o-3 h2oai | 9.8 | Sep 21 | h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization |
| CVE-2025-10768 | H2 h2o-3 h2oai | 9.8 | Sep 21 | h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization |
| CVE-2025-6544 | H2 h2oai/h2o-3 h2oai | 9.8 | Sep 21 | Deserialization Vulnerability in h2oai/h2o-3 |
| CVE-2025-5662 | H2 h2oai/h2o-3 h2oai | 9.8 | Sep 2 | Deserialization Vulnerability in h2oai/h2o-3 |
| CVE-2025-6507 | H2 h2oai/h2o-3 h2oai | 9.8 | Sep 1 | Deserialization of Untrusted Data in h2oai/h2o-3 |
| CVE-2024-45758 | H2 H2o-3 H2oai | 9.1 | Sep 6 | H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution |