Ray — CVE history (PyPI)
Ray
7 CVEs affect the Ray PyPI package (highest CVSS 9.8). Latest disclosed: 2026-07-01. Full CVE history sourced from NVD.
Summary
- Package
Ray(PyPI)- Total CVEs
7- Actively exploited (CISA KEV)
- 0
- Highest CVSS
9.8- Latest disclosed
- 2026-07-01
Recent CVEs (top 7)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-57516 | High | 8.8 | — | 2026-07-01 | Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. |
CVE-2026-41486 | High | 8.8 | — | 2026-05-08 | Ray is an AI compute engine. |
CVE-2026-32981 | High | 7.5 | — | 2026-03-17 | A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. |
CVE-2026-27482 | Medium | 5.9 | — | 2026-02-21 | Ray is an AI compute engine. |
CVE-2025-62593 | — | — | — | 2025-11-26 | Ray is an AI compute engine. |
CVE-2023-48023 | Critical | 9.1 | — | 2023-11-28 | Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. |
CVE-2023-48022 | Critical | 9.8 | — | 2023-11-28 | Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. |
All-time worst (top 6 by CVSS)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2023-48022 | Critical | 9.8 | — | 2023-11-28 | Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. |
CVE-2023-48023 | Critical | 9.1 | — | 2023-11-28 | Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. |
CVE-2026-57516 | High | 8.8 | — | 2026-07-01 | Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. |
CVE-2026-41486 | High | 8.8 | — | 2026-05-08 | Ray is an AI compute engine. |
CVE-2026-32981 | High | 7.5 | — | 2026-03-17 | A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. |
CVE-2026-27482 | Medium | 5.9 | — | 2026-02-21 | Ray is an AI compute engine. |