TI-2026-81528 CVE-2026-116693 · GHSA-x94g-w73q-hpcw
ReDoS in dd-trace URL query string obfuscation
Priority MEDIUM 44
dd-trace is the Datadog APM client for Node.js.
Vulnerabilities
29 records
TI-2026-80928 CVE-2026-116589 · GHSA-p3m5-h5v9-vqj6
Datadog dd-trace-py IAST flaw lets attackers crash Python processes
Priority MEDIUM 42
Datadog dd-trace-py is the Datadog Python APM client.
TI-2026-80927 CVE-2026-116588 · GHSA-3633-r77q-h3v3
ReDoS in Datadog dd-trace-py URL query string obfuscation
Priority MEDIUM 44
Datadog dd-trace-py is the Datadog Python APM client.
Priority MEDIUM 40
dd-trace-cpp is the Datadog distributed tracing library for C++.
TI-2026-37018 CVE-2026-50275
Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS
Priority MEDIUM 40
The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP.
TI-2026-37019 CVE-2026-50276 · GHSA-p5f6-rccc-jv98
dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS
Priority MEDIUM 40
dd-trace-rb is Datadog's client library for Ruby.
TI-2026-37013 CVE-2026-50270 · GHSA-74xj-wh4w-vqxc
dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
Priority MEDIUM 40
dd-trace-java is a Datadog APM client for Java.
TI-2026-39594 CVE-2026-54788 · GHSA-gpwf-4h98-v82q
dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS
Priority MEDIUM 40
dd-trace-rs provides Datadog application performance monitoring for Rust.
TI-2026-32827 CVE-2026-44965 · GHSA-p6pw-xx6v-j4hh
In versions of the Datadog Android application prior to v545-5.9.2, six App Widget…
Priority LOW 24
In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity,…
TI-2026-32826 CVE-2026-44964 · GHSA-jcqx-89jm-9vxr
In versions of the Datadog Android application prior to v545-5.9.2…
Priority LOW 29
In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard.
TI-2026-34936 CVE-2026-47364 · GHSA-9pjj-6mjx-mcc6
Information disclosure in DataDog Android App
Priority LOW 29
In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out.
TI-2026-34935 CVE-2026-47363 · GHSA-j76g-qwmq-5grc
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher…
Priority LOW 28
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, an…
TI-2026-34933 CVE-2026-47361 · GHSA-3fqc-mc38-j2cm
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is…
Priority LOW 28
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversation_id.
TI-2026-34934 CVE-2026-47362 · GHSA-98h7-6m49-37qg
Insecure storage of sensitive information in DataDog Android App
Priority LOW 21
In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags,…
TI-2026-37014 CVE-2026-50271 · GHSA-mw54-j2v2-42hr
dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
Priority MEDIUM 40
Datadog dd-trace-py is the Datadog Python APM client.
TI-2026-37017 CVE-2026-50274 · GHSA-74j5-xf3v-crq8
dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS
Priority MEDIUM 40
Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring.
TI-2026-37015 CVE-2026-50272 · GHSA-wxqq-gcq8-c443
dd-trace: Improper parsing of W3C baggage headers may lead to DoS
Priority MEDIUM 40
dd-trace is the Datadog APM client for Node.js.
TI-2026-37016 CVE-2026-50273 · GHSA-38wr-vpc7-2mp4
Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS
Priority MEDIUM 40
Datadog .NET Tracer is a client library for Datadog APM for .NET applications.
TI-2026-32833 CVE-2026-44971 · GHSA-587r-mc96-6f2p
GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
Priority HIGH 75
GuardDog is a CLI tool to identify malicious PyPI packages.
TI-2026-32834 CVE-2026-44972 · GHSA-m5p4-gvpx-4mvr
GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content
Priority LOW 22
GuardDog is a CLI tool to identify malicious PyPI packages.
TI-2026-26107 CVE-2026-33728 · GHSA-579q-h82j-r5v2
dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution
Priority MEDIUM 49
dd-trace-java is a Datadog APM client for Java.
TI-2026-18363 CVE-2026-22871 · GHSA-xg9w-vg3g-6m68
GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
Priority MEDIUM 42
GuardDog is a CLI tool to identify malicious PyPI packages.
TI-2026-18362 CVE-2026-22870 · GHSA-ffj4-jq7m-9g6v
GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS
Priority LOW 32
GuardDog is a CLI tool to identify malicious PyPI packages.
TI-2025-38100 CVE-2025-61667
Datadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissions
Priority LOW 32
The Datadog Agent collects events and metrics from hosts and sends them to Datadog.
Priority LOW 39
dd-trace-cpp is the Datadog distributed tracing for C++.