RA
Vendor
ray-project
7
CVEs
1
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-41486 | RA ray ray-project | 8.8 | May 8 | Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization |
| CVE-2026-32981 | RA Ray ray-project | 7.5 | Mar 17 | Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure |
| CVE-2026-27482 | RA ray ray-project | 6.5 | Feb 21 | Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion) |
| CVE-2025-62593 In wildKEV | RA ray ray-project | 8.8 | Nov 26 | Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack |
| CVE-2023-6020 | RA Ray Ray Project | 7.5 | Nov 16 | LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication |
| CVE-2023-6021 | RA Ray Ray Project | 7.5 | Nov 16 | LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication |
| CVE-2023-6019 | RA Ray Ray Project | 9.8 | Nov 16 | A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication |