anyscale records
7 published records for vendor anyscale.
Researcher profile
- Entered KEV
- 1 · 14.3%
- Weaponized
- 2 · 28.6%
- Pre-auth RCE
- 4
- With a fix record
- 71.4%
- Median publish → KEV
- 264 days
Recurring classes
- CWE-918 Server-Side Request Forgery (SSRF)2
- CWE-94 Improper Control of Generation of Code ('Code Injection')2
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-396 Declaration of Catch for Generic Exception1
- CWE-502 Deserialization of Untrusted Data1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
7 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
85Now | CVE-2025-62593Weaponized | Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attackanyscale · ray · CWE-94 | Critical9.4 | KEV | 60.1% | Nov 26, 2025 |
64This week | CVE-2023-48022Weaponized | Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API.anyscale · ray · CWE-918 | Critical9.8 | — | 83.9% | Nov 28, 2023 |
47Plan | CVE-2023-48023Proof of concept | Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF.anyscale · ray · CWE-918 | Critical9.1 | — | 35.2% | Nov 28, 2023 |
35Monitor | CVE-2026-41486No exploit | Ray: Remote Code Execution via Parquet Arrow Extension Type Deserializationanyscale · ray · CWE-94 | High8.9 | — | 0.4% | May 8, 2026 |
34Monitor | CVE-2026-32981No exploit | Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosureanyscale · ray · CWE-22 | High8.7 | — | 0.9% | Mar 17, 2026 |
34Monitor | CVE-2026-57516No exploit | Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Readeranyscale · ray · CWE-502 | High8.6 | — | 0.8% | Jul 1, 2026 |
26Monitor | CVE-2026-27482No exploit | Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)anyscale · ray · CWE-396 | Medium6.5 | — | 0.3% | Feb 21, 2026 |
- CVE-2025-6259385Now
Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack
CriticalCVSS 9.4KEVWeaponizedEPSS 60%anyscale · rayNov 26, 2025
- CVE-2023-4802264This week
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API.
CriticalCVSS 9.8WeaponizedEPSS 83%anyscale · rayNov 28, 2023
- CVE-2023-4802347Plan
Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF.
CriticalCVSS 9.1Proof of conceptEPSS 35%anyscale · rayNov 28, 2023
- CVE-2026-4148635Monitor
Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
HighCVSS 8.9No exploitEPSS 0%anyscale · rayMay 8, 2026
- CVE-2026-3298134Monitor
Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure
HighCVSS 8.7No exploitEPSS 0%anyscale · rayMar 17, 2026
- CVE-2026-5751634Monitor
Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader
HighCVSS 8.6No exploitEPSS 0%anyscale · rayJul 1, 2026
- CVE-2026-2748226Monitor
Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
MediumCVSS 6.5No exploitEPSS 0%anyscale · rayFeb 21, 2026