{"items":[{"id":"CVE-2026-116693","published":"2026-10-27T20:07:01.195Z","updated":"2026-10-30T19:25:57.583Z","title":"dd-trace: ReDOS in URL query string obfuscation","severity":"HIGH","score":8.7,"vendor":"DataDog","product":"dd-trace-js","kev":false,"epss":0.00449,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116589","published":"2026-10-26T21:26:58.832Z","updated":"2026-10-31T01:53:57.070Z","title":"Datadog dd-trace-py: IAST instrumentation can lead to application DOS","severity":"HIGH","score":8.2,"vendor":"DataDog","product":"dd-trace-py","kev":false,"epss":0.00328,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116588","published":"2026-10-26T21:22:46.130Z","updated":"2026-11-02T18:14:38.663Z","title":"Datadog dd-trace-py: ReDOS in URL query string obfuscation","severity":"HIGH","score":8.7,"vendor":"DataDog","product":"dd-trace-py","kev":false,"epss":0.00468,"kevAdded":null,"exploit":false},{"id":"CVE-2026-50277","published":"2026-09-17T20:16:37.230Z","updated":"2026-09-21T21:12:32.522Z","title":"dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS","severity":"HIGH","score":7.5,"vendor":"DataDog","product":"dd-trace-cpp","kev":false,"epss":0.00793,"kevAdded":null,"exploit":false},{"id":"CVE-2026-50275","published":"2026-09-17T20:04:26.605Z","updated":"2026-09-18T20:08:45.062Z","title":"Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS","severity":"HIGH","score":7.5,"vendor":"DataDog","product":"dd-trace-php","kev":false,"epss":0.00684,"kevAdded":null,"exploit":false},{"id":"CVE-2026-50276","published":"2026-09-14T17:04:52.744Z","updated":"2026-09-14T17:38:12.401Z","title":"dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS","severity":"HIGH","score":7.5,"vendor":"DataDog","product":"dd-trace-rb","kev":false,"epss":0.00793,"kevAdded":null,"exploit":false},{"id":"CVE-2026-50270","published":"2026-09-14T17:03:39.809Z","updated":"2026-09-14T19:16:55.404Z","title":"dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS","severity":"HIGH","score":7.5,"vendor":"DataDog","product":"dd-trace-java","kev":false,"epss":0.00793,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54788","published":"2026-08-28T16:33:49.032Z","updated":"2026-08-31T18:57:14.867Z","title":"dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS","severity":"HIGH","score":7.5,"vendor":"DataDog","product":"dd-trace-rs","kev":false,"epss":0.00793,"kevAdded":null,"exploit":false},{"id":"CVE-2026-44965","published":"2026-08-07T18:02:35.165Z","updated":"2026-08-08T01:05:53.332Z","title":"In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity,…","severity":"MEDIUM","score":5.5,"vendor":"Datadog","product":"Android App","kev":false,"epss":0.00161,"kevAdded":null,"exploit":false},{"id":"CVE-2026-44964","published":"2026-08-07T18:02:35.145Z","updated":"2026-08-08T01:05:53.334Z","title":"In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed…","severity":"MEDIUM","score":6.5,"vendor":"Datadog","product":"Android App","kev":false,"epss":0.00339,"kevAdded":null,"exploit":false},{"id":"CVE-2026-47364","published":"2026-08-07T18:02:35.142Z","updated":"2026-08-08T01:05:53.273Z","title":"In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out.…","severity":"MEDIUM","score":6.5,"vendor":"Datadog","product":"Android App","kev":false,"epss":0.00438,"kevAdded":null,"exploit":false},{"id":"CVE-2026-47363","published":"2026-08-07T18:02:35.043Z","updated":"2026-08-08T01:05:53.203Z","title":"In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including…","severity":"MEDIUM","score":6.3,"vendor":"Datadog","product":"Android App","kev":false,"epss":0.00264,"kevAdded":null,"exploit":false},{"id":"CVE-2026-47361","published":"2026-08-07T18:02:34.957Z","updated":"2026-08-08T01:05:53.248Z","title":"In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a…","severity":"MEDIUM","score":6.4,"vendor":"Datadog","product":"Android App","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2026-47362","published":"2026-08-07T18:02:34.902Z","updated":"2026-08-08T01:05:53.195Z","title":"In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext:…","severity":"MEDIUM","score":4.6,"vendor":"Datadog","product":"Android App","kev":false,"epss":0.00244,"kevAdded":null,"exploit":false},{"id":"CVE-2026-50271","published":"2026-07-17T20:42:34.036Z","updated":"2026-07-20T19:16:57.759Z","title":"dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS","severity":"HIGH","score":7.5,"vendor":"DataDog","product":"dd-trace-py","kev":false,"epss":0.00793,"kevAdded":null,"exploit":false},{"id":"CVE-2026-50274","published":"2026-07-17T20:41:27.675Z","updated":"2026-07-20T15:04:14.809Z","title":"dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS","severity":"HIGH","score":7.5,"vendor":"DataDog","product":"dd-trace-go","kev":false,"epss":0.00793,"kevAdded":null,"exploit":false},{"id":"CVE-2026-50272","published":"2026-07-17T20:28:21.250Z","updated":"2026-07-21T02:19:01.666Z","title":"dd-trace: Improper parsing of W3C baggage headers may lead to DoS","severity":"HIGH","score":7.5,"vendor":"DataDog","product":"dd-trace-js","kev":false,"epss":0.00793,"kevAdded":null,"exploit":false},{"id":"CVE-2026-50273","published":"2026-07-17T18:01:14.533Z","updated":"2026-07-17T19:46:45.397Z","title":"Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS","severity":"HIGH","score":7.5,"vendor":"DataDog","product":"dd-trace-dotnet","kev":false,"epss":0.00793,"kevAdded":null,"exploit":false},{"id":"CVE-2026-44971","published":"2026-05-27T14:43:18.643Z","updated":"2026-05-27T16:09:24.880Z","title":"GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration","severity":"HIGH","score":8.2,"vendor":"DataDog","product":"guarddog","kev":false,"epss":0.0024,"kevAdded":null,"exploit":true},{"id":"CVE-2026-44972","published":"2026-05-27T14:42:00.807Z","updated":"2026-05-27T15:34:32.271Z","title":"GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content","severity":"MEDIUM","score":5,"vendor":"DataDog","product":"guarddog","kev":false,"epss":0.00113,"kevAdded":null,"exploit":false},{"id":"CVE-2026-33728","published":"2026-03-27T00:25:56.444Z","updated":"2026-03-27T19:57:29.854Z","title":"dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution","severity":"CRITICAL","score":9.3,"vendor":"DataDog","product":"dd-trace-java","kev":false,"epss":0.00712,"kevAdded":null,"exploit":false},{"id":"CVE-2026-22871","published":"2026-01-13T20:46:57.324Z","updated":"2026-01-13T21:24:07.742Z","title":"GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE","severity":"HIGH","score":8.7,"vendor":"DataDog","product":"guarddog","kev":false,"epss":0.01064,"kevAdded":null,"exploit":false},{"id":"CVE-2026-22870","published":"2026-01-13T20:43:43.132Z","updated":"2026-01-13T21:23:53.024Z","title":"GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS","severity":"HIGH","score":7.1,"vendor":"DataDog","product":"guarddog","kev":false,"epss":0.00511,"kevAdded":null,"exploit":false},{"id":"CVE-2025-61667","published":"2025-11-12T18:50:02.940Z","updated":"2025-11-12T21:04:11.852Z","title":"Datadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissions","severity":"HIGH","score":7,"vendor":"DataDog","product":"datadog-agent","kev":false,"epss":0.00116,"kevAdded":null,"exploit":false},{"id":"CVE-2024-38525","published":"2024-06-28T21:10:57.138Z","updated":"2024-08-02T04:12:25.118Z","title":"dd-trace-cpp malformed unicode header values may cause crash","severity":"HIGH","score":7.5,"vendor":"DataDog","product":"dd-trace-cpp","kev":false,"epss":0.00431,"kevAdded":null,"exploit":false},{"id":"CVE-2023-38704","published":"2023-08-07T19:24:33.271Z","updated":"2024-10-03T18:05:54.891Z","title":"import-in-the-middle allows unsanitized user controlled input in module generation","severity":"HIGH","score":8.1,"vendor":"DataDog","product":"import-in-the-middle","kev":false,"epss":0.01,"kevAdded":null,"exploit":false},{"id":"CVE-2022-23531","published":"2022-12-16T23:41:15.078Z","updated":"2025-04-17T14:33:54.287Z","title":"Arbitrary file write when scanning a specially-crafted local PyPI package","severity":"MEDIUM","score":5.8,"vendor":"DataDog","product":"guarddog","kev":false,"epss":0.00734,"kevAdded":null,"exploit":false},{"id":"CVE-2022-23530","published":"2022-12-16T22:56:33.204Z","updated":"2025-04-17T14:34:26.895Z","title":"GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package","severity":"MEDIUM","score":5.8,"vendor":"DataDog","product":"guarddog","kev":false,"epss":0.00751,"kevAdded":null,"exploit":true},{"id":"CVE-2021-21331","published":"2021-03-03T23:00:19.000Z","updated":"2024-08-03T18:09:15.420Z","title":"DataDog API Client contains a Local Information Disclosure Vulnerability","severity":"LOW","score":3,"vendor":"DataDog","product":"datadog-api-client-java","kev":false,"epss":0.00678,"kevAdded":null,"exploit":false}]}