ray vulnerabilities — 23 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →

Severity	Vulnerability	Package	Ecosystem	Disclosed	Fixed version
8.8 high	CVE-2026-57516: Ray Package Arbitrary Code Execution via Unsafe Deserialization	`ray`	PyPI	24 Jul 2026	2.56.0
Unrated	CVE-2026-57516: Ray Package Unsafe Deserialization Vulnerability Leading to Remote Code Execution	`ray`	PyPI	01 Jul 2026	2.56.0
9.8 critical	CVE-2023-6019: Ray OS Command Injection Vulnerability	`ray`	PyPI	29 Jun 2026	2.8.1
9.8 critical	CVE-2023-48022: Ray Package Arbitrary Code Execution via Job Submission API	`ray`	PyPI	29 Jun 2026	No fix published
9.3 critical	CVE-2023-6020: Ray Package LFI Vulnerability Allows Unauthorized File Access	`ray`	PyPI	29 Jun 2026	2.8.1
9.3 critical	CVE-2023-6021: Ray Path Traversal Vulnerability in Ray Package	`ray`	PyPI	29 Jun 2026	2.8.1
9.4 critical	CVE-2025-62593: Ray Critical RCE Vulnerability via DNS Rebinding in Safari & Firefox	`ray`	PyPI	29 Jun 2026	2.52.0
9.3 critical	CVE-2025-34351: Ray Package Token Authentication Disabled by Default	`ray`	PyPI	29 Jun 2026	No fix published
8.8 high	CVE-2026-41486: Ray Package Arbitrary Code Execution Vulnerability	`ray`	PyPI	08 May 2026	No fix published
8.9 high	CVE-2026-41486: Ray Remote Code Execution via Parquet Arrow Extension Type Deserialization	`ray`	PyPI	24 Apr 2026	2.55.0
7.5 high	CVE-2026-32981: Ray Package Path Traversal Vulnerability in Ray Dashboard	`ray`	PyPI	17 Mar 2026	2.8.1
7.5 high	CVE-2026-32981: Path Traversal Vulnerability in Ray Package Allows Local File Disclosure	`ray`	PyPI	17 Mar 2026	2.8.1
6.5 medium	CVE-2026-27482: Ray Package Unauthenticated DELETE Requests Vulnerability	`ray`	PyPI	21 Feb 2026	2.54.0
5.9 medium	CVE-2026-27482: Ray Package Unauthenticated DELETE Endpoints Allow Browser-Triggered DoS	`ray`	PyPI	20 Feb 2026	2.54.0
9.3 critical	CVE-2025-34351: Ray Package Token Authentication Disabled by Default	`ray`	PyPI	27 Nov 2025	No fix published
9.4 critical	CVE-2025-62593: Ray Critical RCE Vulnerability via DNS Rebinding in Safari & Firefox	`ray`	PyPI	26 Nov 2025	2.52.0
6.4 medium	CVE-2025-1979: Ray Package Vulnerable to Sensitive Information Logging	`ray`	PyPI	06 Mar 2025	2.43.0
Unrated	CVE-2025-1979: Ray Package Vulnerability Exposes Redis Password in Logs	`ray`	PyPI	06 Mar 2025	64a2e4010522d60b90c389634f24df77b603d85d
9.8 critical	CVE-2024-57000: Command Injection Vulnerability in Ray	`ray`	PyPI	12 Feb 2025	No fix published
9.8 critical	CVE-2023-48022: Ray Package Arbitrary Code Execution via Job Submission API	`ray`	PyPI	28 Nov 2023	No fix published

Subscribe to Vulert on Telegram

Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.

Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.