PyPI - OSV

GHSA-hhrp-gw25-jr43

PyPI/ray

Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False) 24 Jul

Fix available
Severity - 8.6 (High)

PYSEC-2026-1074

PyPI/ray-mcp-server

Malicious code in ray-mcp-server (PyPI) 07 Jul

No fix available

PYSEC-2026-2273

PyPI/ray

See record for full details 01 Jul

Fix available
Severity - 8.6 (High)

PYSEC-2026-515

PyPI/ray

Ray Path Traversal vulnerability 29 Jun

Fix available
Severity - 9.3 (Critical)

PYSEC-2026-517

PyPI/ray

Ray has arbitrary code execution via jobs submission API 29 Jun

No fix available
Severity - 9.8 (Critical)

PYSEC-2026-516

PyPI/ray

Ray Missing Authorization vulnerability 29 Jun

Fix available
Severity - 9.3 (Critical)

PYSEC-2026-519

PyPI/ray

Ray OS Command Injection vulnerability 29 Jun

Fix available
Severity - 9.8 (Critical)

PYSEC-2026-520

PyPI/ray

Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack 29 Jun

Fix available
Severity - 9.4 (Critical)

PYSEC-2026-518

PyPI/ray

Ray's New Token Authentication is Disabled By Default 29 Jun

No fix available
Severity - 9.3 (Critical)

MAL-2026-5325

PyPI/ray-mcp-server

Malicious code in ray-mcp-server (PyPI) 06 Jun

No fix available

PYSEC-2026-2272

PyPI/ray

See record for full details 08 May

No fix available
Severity - 8.8 (High)

PYSEC-2026-2296

PyPI/ve-ray

See record for full details 08 May

No fix available
Severity - 8.8 (High)

GHSA-mw35-8rx3-xf9r

PyPI/ray

Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization 24 Apr

Fix available
Severity - 8.9 (High)

GHSA-j3mh-qmjj-xp83

PyPI/ray

Ray Dashboard is vulnerable to path traversal through its static file handling mechanism 17 Mar

Fix available
Severity - 8.7 (High)

PYSEC-2026-130

PyPI/ray

See record for full details 17 Mar

Fix available
Severity - 7.5 (High)

PYSEC-2026-2271

PyPI/ray

See record for full details 21 Feb

Fix available
Severity - 6.5 (Medium)

Vulnerabilities