h2oai vulnerabilities

CVEs per yearBy the year they were published

1. 20235
2. 20244
3. 202515
4. 20266

Newest CVEs

• CVE-2026-65700

  h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API

  h2oai · h2ogpt

  Critical9.3
• CVE-2026-8752

  h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control

  h2oai · h2o-3

  Medium6.9
• CVE-2026-8751

  h2oai h2o-3 JAR Model.java importBinaryModel deserialization

  h2oai · h2o-3

  Medium6.9
• CVE-2026-8750

  h2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure

  h2oai · h2o-3

  Medium6.9
• CVE-2026-3960

  Remote Code Execution in h2oai/h2o-3

  h2oai · h2oai/h2o-3

  Medium5.9
• CVE-2024-5986

  Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3

  h2oai · h2oai/h2o-3

  Critical9.1
• CVE-2025-10769

  h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization

  h2oai · h2o-3

  Medium5.3
• CVE-2025-10768

  h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization

  h2oai · h2o-3

  Medium5.3
• CVE-2025-6544

  Deserialization Vulnerability in h2oai/h2o-3

  h2oai · h2oai/h2o-3

  Critical9.8
• CVE-2025-5662

  Deserialization Vulnerability in h2oai/h2o-3

  h2oai · h2oai/h2o-3

  Critical9.8