{"data":{"ecosystem":"pypi","name":"ray","url":"https://aisecwatch.com/packages/pypi/ray","latestVersion":"2.59.0","firstReleaseAt":"2017-06-03T03:05:01.138Z","repository":"https://github.com/ray-project/ray","llm":{"exposure":"none","depth":null,"integratedAt":null,"integratedVersion":null,"sdks":[],"path":[]},"authority":{"profile":["http"],"fromDependencies":["pypi:aiohttp","pypi:requests"]},"dependencies":[{"ecosystem":"pypi","name":"vllm","versionSpec":"==0.27.0","scope":"extra:llm"},{"ecosystem":"pypi","name":"aiohttp","versionSpec":">=3.14.1","scope":"extra:default"},{"ecosystem":"pypi","name":"aiohttp-cors","versionSpec":null,"scope":"extra:default"},{"ecosystem":"pypi","name":"async-timeout","versionSpec":null,"scope":"extra:llm"},{"ecosystem":"pypi","name":"celery","versionSpec":null,"scope":"extra:serve-async-inference"},{"ecosystem":"pypi","name":"click","versionSpec":">=7.0","scope":"runtime"},{"ecosystem":"pypi","name":"colorful","versionSpec":null,"scope":"extra:default"},{"ecosystem":"pypi","name":"cupy-cuda12x","versionSpec":null,"scope":"extra:cgraph"},{"ecosystem":"pypi","name":"dm-tree","versionSpec":null,"scope":"extra:rllib"},{"ecosystem":"pypi","name":"fastapi","versionSpec":">=0.133.0","scope":"extra:serve"},{"ecosystem":"pypi","name":"filelock","versionSpec":null,"scope":"runtime"},{"ecosystem":"pypi","name":"fsspec","versionSpec":null,"scope":"extra:data"},{"ecosystem":"pypi","name":"grpcio","versionSpec":"!=1.56.0","scope":"extra:client"},{"ecosystem":"pypi","name":"gymnasium","versionSpec":"==1.2.2","scope":"extra:rllib"},{"ecosystem":"pypi","name":"hf-transfer","versionSpec":null,"scope":"extra:llm"},{"ecosystem":"pypi","name":"jinja2","versionSpec":null,"scope":"extra:serve"},{"ecosystem":"pypi","name":"jsonref","versionSpec":">=1.1.0","scope":"extra:llm"},{"ecosystem":"pypi","name":"jsonschema","versionSpec":null,"scope":"runtime"},{"ecosystem":"pypi","name":"lz4","versionSpec":null,"scope":"extra:rllib"},{"ecosystem":"pypi","name":"memray","versionSpec":null,"scope":"extra:observability"},{"ecosystem":"pypi","name":"meson","versionSpec":null,"scope":"extra:llm"},{"ecosystem":"pypi","name":"mmh3","versionSpec":null,"scope":"extra:serve"},{"ecosystem":"pypi","name":"msgpack","versionSpec":"<2.0.0,>=1.0.0","scope":"runtime"},{"ecosystem":"pypi","name":"ninja","versionSpec":null,"scope":"extra:llm"},{"ecosystem":"pypi","name":"nixl","versionSpec":"==1.3.1","scope":"extra:llm"},{"ecosystem":"pypi","name":"nixl-cu13","versionSpec":"==1.3.1","scope":"extra:llm"},{"ecosystem":"pypi","name":"numpy","versionSpec":">=1.20","scope":"extra:data"},{"ecosystem":"pypi","name":"opencensus","versionSpec":null,"scope":"extra:default"},{"ecosystem":"pypi","name":"opentelemetry-exporter-prometheus","versionSpec":null,"scope":"extra:default"},{"ecosystem":"pypi","name":"opentelemetry-proto","versionSpec":null,"scope":"extra:default"},{"ecosystem":"pypi","name":"opentelemetry-sdk","versionSpec":">=1.30.0","scope":"extra:default"},{"ecosystem":"pypi","name":"ormsgpack","versionSpec":">=1.7.0","scope":"extra:rllib"},{"ecosystem":"pypi","name":"packaging","versionSpec":">=24.2","scope":"runtime"},{"ecosystem":"pypi","name":"pandas","versionSpec":">=2.2.3","scope":"extra:data"},{"ecosystem":"pypi","name":"prometheus-client","versionSpec":">=0.7.1","scope":"extra:default"},{"ecosystem":"pypi","name":"protobuf","versionSpec":">=3.20.3","scope":"runtime"},{"ecosystem":"pypi","name":"pyarrow","versionSpec":">=17.0.0","scope":"extra:data"},{"ecosystem":"pypi","name":"pybind11","versionSpec":null,"scope":"extra:llm"},{"ecosystem":"pypi","name":"pydantic","versionSpec":"<3,>=2.5.0","scope":"extra:default"},{"ecosystem":"pypi","name":"pyopenssl","versionSpec":null,"scope":"extra:serve-grpc"},{"ecosystem":"pypi","name":"py-spy","versionSpec":">=0.2.0","scope":"extra:default"},{"ecosystem":"pypi","name":"pyyaml","versionSpec":null,"scope":"runtime"},{"ecosystem":"pypi","name":"ray-cpp","versionSpec":"==2.59.0","scope":"extra:cpp"},{"ecosystem":"pypi","name":"ray-haproxy","versionSpec":"<2.9.0,>=2.8.25","scope":"extra:serve"},{"ecosystem":"pypi","name":"requests","versionSpec":null,"scope":"runtime"},{"ecosystem":"pypi","name":"scipy","versionSpec":null,"scope":"extra:rllib"},{"ecosystem":"pypi","name":"smart-open","versionSpec":null,"scope":"extra:default"},{"ecosystem":"pypi","name":"starlette","versionSpec":">=1.0.1","scope":"extra:serve"},{"ecosystem":"pypi","name":"taskiq","versionSpec":null,"scope":"extra:serve-async-inference"},{"ecosystem":"pypi","name":"tensorboardx","versionSpec":">=1.9","scope":"extra:tune"},{"ecosystem":"pypi","name":"typer","versionSpec":null,"scope":"extra:llm"},{"ecosystem":"pypi","name":"uvicorn","versionSpec":null,"scope":"extra:serve"},{"ecosystem":"pypi","name":"virtualenv","versionSpec":"!=20.21.1,>=20.0.24","scope":"extra:default"},{"ecosystem":"pypi","name":"watchfiles","versionSpec":null,"scope":"extra:serve"}],"advisories":[{"id":"f092b419-101b-4be5-97ed-68be2d95878e","url":"https://aisecwatch.com/issues/f092b419-101b-4be5-97ed-68be2d95878e","cveId":"CVE-2026-41486","title":"GHSA-mw35-8rx3-xf9r: Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization","severity":"high","publishedAt":"2026-04-24T16:15:00.000Z","affected":["ray@>= 2.49.0, < 2.55.0 (fixed: 2.55.0)"],"epssScore":0.00704},{"id":"f7b3d095-f976-4909-ba8a-9a10b7e1e9f0","url":"https://aisecwatch.com/issues/f7b3d095-f976-4909-ba8a-9a10b7e1e9f0","cveId":"CVE-2026-27482","title":"GHSA-q5fh-2hc8-f6rq: Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)","severity":"medium","publishedAt":"2026-02-20T21:15:25.000Z","affected":["ray@< 2.54.0 (fixed: 2.54.0)"],"epssScore":0.00397},{"id":"5555aadc-e8bf-4705-b26d-920a43b3cc89","url":"https://aisecwatch.com/issues/5555aadc-e8bf-4705-b26d-920a43b3cc89","cveId":"CVE-2025-62593","title":"CVE-2025-62593: Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be…","severity":"critical","publishedAt":"2025-11-27T04:15:47.927Z","affected":["ray@< 2.52.0 (fixed: 2.52.0)"],"epssScore":0.62459},{"id":"e7ee4651-1fb5-492c-aab0-bf09444c7b0c","url":"https://aisecwatch.com/issues/e7ee4651-1fb5-492c-aab0-bf09444c7b0c","cveId":"CVE-2023-6020","title":"CVE-2023-6020: LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.","severity":"high","publishedAt":"2023-11-17T02:15:09.443Z","affected":["ray@< 2.8.1 (fixed: 2.8.1)"],"epssScore":0.14652},{"id":"fe8f931e-8949-401f-b9da-c562913b3776","url":"https://aisecwatch.com/issues/fe8f931e-8949-401f-b9da-c562913b3776","cveId":"CVE-2023-6021","title":"CVE-2023-6021: LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is…","severity":"high","publishedAt":"2023-11-16T22:15:09.020Z","affected":["ray@< 2.8.1 (fixed: 2.8.1)"],"epssScore":0.37076}],"checkedAt":"2026-10-09T21:54:23.431Z"},"meta":{"advisoryMatching":"by package name; advisory records do not state an ecosystem"}}