Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
PYSEC-2026-1074
  • PyPI/ray-mcp-server
 Malicious code in ray-mcp-server (PyPI) 07 Jul
  • No fix available
PYSEC-2026-2273
  • PyPI/ray
 See record for full details 01 Jul
  • Fix available
  • Severity - 8.6 (High)
PYSEC-2026-515
  • PyPI/ray
 Ray Path Traversal vulnerability 29 Jun
  • Fix available
  • Severity - 9.3 (Critical)
PYSEC-2026-517
  • PyPI/ray
 Ray has arbitrary code execution via jobs submission API 29 Jun
  • No fix available
  • Severity - 9.8 (Critical)
PYSEC-2026-516
  • PyPI/ray
 Ray Missing Authorization vulnerability 29 Jun
  • Fix available
  • Severity - 9.3 (Critical)
PYSEC-2026-519
  • PyPI/ray
 Ray OS Command Injection vulnerability 29 Jun
  • Fix available
  • Severity - 9.8 (Critical)
PYSEC-2026-520
  • PyPI/ray
 Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack 29 Jun
  • Fix available
  • Severity - 9.4 (Critical)
PYSEC-2026-518
  • PyPI/ray
 Ray's New Token Authentication is Disabled By Default 29 Jun
  • No fix available
  • Severity - 9.3 (Critical)
MAL-2026-5325
  • PyPI/ray-mcp-server
 Malicious code in ray-mcp-server (PyPI) 06 Jun
  • No fix available
PYSEC-2026-2272
  • PyPI/ray
 See record for full details 08 May
  • No fix available
  • Severity - 8.8 (High)
PYSEC-2026-2296
  • PyPI/ve-ray
 See record for full details 08 May
  • No fix available
  • Severity - 8.8 (High)
GHSA-mw35-8rx3-xf9r
  • PyPI/ray
 Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization 24 Apr
  • Fix available
  • Severity - 8.9 (High)
GHSA-j3mh-qmjj-xp83
  • PyPI/ray
 Ray Dashboard is vulnerable to path traversal through its static file handling mechanism 17 Mar
  • Fix available
  • Severity - 8.7 (High)
PYSEC-2026-130
  • PyPI/ray
 See record for full details 17 Mar
  • Fix available
  • Severity - 7.5 (High)
PYSEC-2026-2271
  • PyPI/ray
 See record for full details 21 Feb
  • Fix available
  • Severity - 6.5 (Medium)
GHSA-q5fh-2hc8-f6rq
  • PyPI/ray
 Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion) 20 Feb
  • Fix available
  • Severity - 5.9 (Medium)
Load more...(1 page left)