ray has 8 CVEs on record between 2023 and 2026. The median CVSS is 9.3 (critical), with 5 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.3
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Products
- ray 8
Worst active — by depth score
CVE-2023-48022Critical· 9.8Ray has arbitrary code execution via jobs submission API83CVE-2023-6019Critical· 9.8Ray OS Command Injection vulnerability81CVE-2023-6021Critical· 9.3Ray Path Traversal vulnerability71CVE-2023-6020Critical· 9.3Ray Missing Authorization vulnerability66CVE-2025-34351CriticalRay's New Token Authentication is Disabled By Default52
ray vulnerabilities
CVEs affecting ray, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
CVE-2026-41486HighRay: Remote Code Execution via Parquet Arrow Extension Type Deserialization
Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
CVE-2026-27482Medium· 5.9Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
CVE-2025-34351CriticalRay's New Token Authentication is Disabled By Default
Ray's New Token Authentication is Disabled By Default
CVE-2025-1979Medium· 6.4ray vulnerable to Insertion of Sensitive Information into Log File
ray vulnerable to Insertion of Sensitive Information into Log File
CVE-2023-48022Critical· 9.8PoCRay has arbitrary code execution via jobs submission API
Ray has arbitrary code execution via jobs submission API
CVE-2023-6019Critical· 9.8PoCRay OS Command Injection vulnerability
Ray OS Command Injection vulnerability
CVE-2023-6020Critical· 9.3PoCRay Missing Authorization vulnerability
Ray Missing Authorization vulnerability
CVE-2023-6021Critical· 9.3PoCRay Path Traversal vulnerability
Ray Path Traversal vulnerability