TI-2026-32833 CVE-2026-44971 · GHSA-587r-mc96-6f2p
GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
Priority HIGH 75
GuardDog is a CLI tool to identify malicious PyPI packages.
DataDog
Records29All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high18CVSS 7.0–8.9
Exploited now
DataDog records in CISA KEVNo DataDog vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
29 records
TI-2022-07587 CVE-2022-23530 · GHSA-78m5-jpmf-ch7v
GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package
Priority MEDIUM 62
GuardDog is a CLI tool to identify malicious PyPI packages.
TI-2026-26107 CVE-2026-33728 · GHSA-579q-h82j-r5v2
dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution
Priority MEDIUM 49
dd-trace-java is a Datadog APM client for Java.
TI-2026-81528 CVE-2026-116693 · GHSA-x94g-w73q-hpcw
ReDoS in dd-trace URL query string obfuscation
Priority MEDIUM 44
dd-trace is the Datadog APM client for Node.js.
TI-2026-80927 CVE-2026-116588 · GHSA-3633-r77q-h3v3
ReDoS in Datadog dd-trace-py URL query string obfuscation
Priority MEDIUM 44
Datadog dd-trace-py is the Datadog Python APM client.
TI-2023-20052 CVE-2023-38704 · GHSA-5r27-rw8r-7967
import-in-the-middle allows unsanitized user controlled input in module generation
Priority MEDIUM 44
import-in-the-middle is a module loading interceptor specifically for ESM modules.
TI-2026-80928 CVE-2026-116589 · GHSA-p3m5-h5v9-vqj6
Datadog dd-trace-py IAST flaw lets attackers crash Python processes
Priority MEDIUM 42
Datadog dd-trace-py is the Datadog Python APM client.
TI-2026-18363 CVE-2026-22871 · GHSA-xg9w-vg3g-6m68
GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
Priority MEDIUM 42
GuardDog is a CLI tool to identify malicious PyPI packages.
TI-2026-39594 CVE-2026-54788 · GHSA-gpwf-4h98-v82q
dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS
Priority MEDIUM 40
dd-trace-rs provides Datadog application performance monitoring for Rust.
Priority MEDIUM 40
dd-trace-cpp is the Datadog distributed tracing library for C++.
TI-2026-37019 CVE-2026-50276 · GHSA-p5f6-rccc-jv98
dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS
Priority MEDIUM 40
dd-trace-rb is Datadog's client library for Ruby.
TI-2026-37018 CVE-2026-50275
Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS
Priority MEDIUM 40
The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP.
TI-2026-37017 CVE-2026-50274 · GHSA-74j5-xf3v-crq8
dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS
Priority MEDIUM 40
Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring.
TI-2026-37016 CVE-2026-50273 · GHSA-38wr-vpc7-2mp4
Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS
Priority MEDIUM 40
Datadog .NET Tracer is a client library for Datadog APM for .NET applications.
TI-2026-37015 CVE-2026-50272 · GHSA-wxqq-gcq8-c443
dd-trace: Improper parsing of W3C baggage headers may lead to DoS
Priority MEDIUM 40
dd-trace is the Datadog APM client for Node.js.
TI-2026-37014 CVE-2026-50271 · GHSA-mw54-j2v2-42hr
dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
Priority MEDIUM 40
Datadog dd-trace-py is the Datadog Python APM client.
TI-2026-37013 CVE-2026-50270 · GHSA-74xj-wh4w-vqxc
dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
Priority MEDIUM 40
dd-trace-java is a Datadog APM client for Java.
Priority LOW 39
dd-trace-cpp is the Datadog distributed tracing for C++.
TI-2022-07588 CVE-2022-23531 · GHSA-rp2v-v467-q9vq
Arbitrary file write when scanning a specially-crafted local PyPI package
Priority LOW 35
GuardDog is a CLI tool to identify malicious PyPI packages.
TI-2026-18362 CVE-2026-22870 · GHSA-ffj4-jq7m-9g6v
GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS
Priority LOW 32
GuardDog is a CLI tool to identify malicious PyPI packages.
TI-2025-38100 CVE-2025-61667
Datadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissions
Priority LOW 32
The Datadog Agent collects events and metrics from hosts and sends them to Datadog.
TI-2026-34936 CVE-2026-47364 · GHSA-9pjj-6mjx-mcc6
Information disclosure in DataDog Android App
Priority LOW 29
In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out.
TI-2026-32826 CVE-2026-44964 · GHSA-jcqx-89jm-9vxr
In versions of the Datadog Android application prior to v545-5.9.2…
Priority LOW 29
In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard.
TI-2026-34935 CVE-2026-47363 · GHSA-j76g-qwmq-5grc
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher…
Priority LOW 28
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, an…
TI-2026-34933 CVE-2026-47361 · GHSA-3fqc-mc38-j2cm
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is…
Priority LOW 28
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversation_id.