Ray
12 CVEs tracked. 1 of them are in CISA KEV.
This hub aggregates every CVE we track for Ray, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Ray CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 1 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 1 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 1 |
| 2026-03 | 1 |
| 2026-04 | 0 |
| 2026-05 | 1 |
| 2026-06 | 0 |
| 2026-07 | 1 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 12 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical4
- High6
- Medium2
Latest CVEs
The 12 most recently published vulnerabilities affecting Ray.
- CVE-2026-57516Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader8.8
- CVE-2026-41486Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization8.8
- CVE-2026-32981Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure7.5
- CVE-2026-27482Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)5.9
- CVE-2025-62593Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack8.8
- CVE-2025-1979Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password ...6.4
- CVE-2023-48023Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a ...9.1
- CVE-2023-48022Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in i...9.8
- CVE-2023-6020Ray Static File Local File Include7.5
- CVE-2023-6019Ray Command Injection in cpu_profile Parameter9.8
- CVE-2023-6021Ray Log File Local File Include7.5
- CVE-2008-3166PHP remote file inclusion vulnerability in modules/global/inc/content.inc.php in BoonEx Ray 3.5, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in...9.3
Product grouping is registry-driven, with AI assist and human review. How it works