DataDog

Products

Exploited and recent CVEs

• CVE-2026-116693 High 8.7 dd-trace: ReDOS in URL query string obfuscation 0.4%
• CVE-2026-116589 High 8.2 Datadog dd-trace-py: IAST instrumentation can lead to application DOS 0.3%
• CVE-2026-116588 High 8.7 Datadog dd-trace-py: ReDOS in URL query string obfuscation 0.5%
• CVE-2026-50277 High 7.5 dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS 0.8%
• CVE-2026-50275 High 7.5 Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS 0.7%
• CVE-2026-50276 High 7.5 dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS 0.8%
• CVE-2026-50270 High 7.5 dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS 0.8%
• CVE-2026-54788 High 7.5 dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS 0.8%
• CVE-2026-44965 Medium 5.5 In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallP 0.2%
• CVE-2026-44964 Medium 6.5 In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-con 0.3%
• CVE-2026-47364 Medium 6.5 In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash 0.4%
• CVE-2026-47363 Medium 6.3 In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no 0.3%
• CVE-2026-47361 Medium 6.4 In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversation_id. When the a 0.3%
• CVE-2026-47362 Medium 4.6 In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recip 0.2%
• CVE-2026-50271 High 7.5 dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS 0.8%
• CVE-2026-50274 High 7.5 dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS 0.8%
• CVE-2026-50272 High 7.5 dd-trace: Improper parsing of W3C baggage headers may lead to DoS 0.8%
• CVE-2026-50273 High 7.5 Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS 0.8%
• CVE-2026-44971 High 8.2 GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration 0.2%
• CVE-2026-44972 Medium 5.0 GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content 0.1%
• CVE-2026-33728 Critical 9.3 dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution 0.7%
• CVE-2026-22871 High 8.7 GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE 1.1%
• CVE-2026-22870 High 7.1 GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS 0.5%
• CVE-2025-61667 High 7.0 Datadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissions 0.1%
• CVE-2024-38525 High 7.5 dd-trace-cpp malformed unicode header values may cause crash 0.4%
• CVE-2023-38704 High 8.1 import-in-the-middle allows unsanitized user controlled input in module generation 1.0%
• CVE-2022-23531 Medium 5.8 Arbitrary file write when scanning a specially-crafted local PyPI package 0.7%
• CVE-2022-23530 Medium 5.8 GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package 0.8%
• CVE-2021-21331 Low 3.0 DataDog API Client contains a Local Information Disclosure Vulnerability 0.7%