TI-2025-38808 CVE-2025-62593 · GHSA-q279-jhrf-cc6v
Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack
Priority CRITICAL 100KEV
Ray is an AI compute engine.
Anyscale, Inc
Records7All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
Anyscale, Inc records in CISA KEVComponents
Products in the NVD configurations · select one to filter the recordsRecords
7 records
TI-2023-26002 CVE-2023-48022 · GHSA-6wgj-66m2-xxp2
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the…
Priority CRITICAL 90
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API.
TI-2023-26003 CVE-2023-48023 · GHSA-3xqf-mvhg-35j8
Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF.
Priority HIGH 80
Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF.
TI-2026-25429 CVE-2026-32981 · GHSA-j3mh-qmjj-xp83
Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure
Priority HIGH 77
A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1.
TI-2026-41407 CVE-2026-57516 · GHSA-hhrp-gw25-jr43
Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader
Priority HIGH 72
Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function.
TI-2026-21889 CVE-2026-27482 · GHSA-q5fh-2hc8-f6rq
Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
Priority MEDIUM 62
Ray is an AI compute engine.
TI-2026-30073 CVE-2026-41486 · GHSA-mw35-8rx3-xf9r
Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
Priority MEDIUM 47
Ray is an AI compute engine.