ray-project vulnerabilities
7 published CVEs name ray-project among the affected products; CISA lists 1 of them as exploited in the wild.
- Published CVEs
- 7
- Last 12 months
- 4
- Critical
- 2
- Known exploited
- 1
Critical 2High 4Medium 1Low 0Not scored 0
CVEs per yearBy the year they were published
- 20233
- 20251
- 20263
Known exploitedNewest addition to KEV first
- CVE-2025-62593
Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack
ray-project · ray
ExploitedCritical9.4
Newest CVEs
- CVE-2026-41486
Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
ray-project · ray
High8.9 - CVE-2026-32981
Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure
ray-project · Ray
High8.7 - CVE-2026-27482
Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
ray-project · ray
Medium5.9 - CVE-2025-62593
Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack
ray-project · ray
ExploitedCritical9.4 - CVE-2023-6020
Ray Static File Local File Include
ray-project · ray-project/ray
High7.5 - CVE-2023-6019
Ray Command Injection in cpu_profile Parameter
ray-project · ray-project/ray
Critical9.8 - CVE-2023-6021
Ray Log File Local File Include
ray-project · ray-project/ray
High7.5