Login Request a demo
RA
Product
ray
by ray-project · last CVE May 8, 2026
On CISA KEVExploited in the wild
7
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities7In the news3Timeline
Severity mix
Critical 1High 5Medium 1Low 0
Severity
All severities7Critical1High5Medium1Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add ray to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-62593
In wildKEV
8.8
60%
Nov 26
Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack
Affected: < 2.52.0
CVE-2023-6019
9.8
75%
Nov 16
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication
Affected: All versions, or not specified
CVE-2026-41486
8.8
0%
May 8
Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
Affected: >= 2.54.0, < 2.55.0
CVE-2026-32981
7.5
1%
Mar 17
Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure
Affected: before 2.8.1
CVE-2023-6020
7.5
15%
Nov 16
LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication
Affected: All versions, or not specified
CVE-2023-6021
7.5
37%
Nov 16
LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication
Affected: All versions, or not specified
CVE-2026-27482
6.5
0%
Feb 21
Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
Affected: < 2.54.0
Showing 7