DA
Vendor
DataDog
21
CVEs
0
On KEV
3
New 30D
Products
DD8.7
dd-trace-py
DataDog
3 CVEs0 on KEV2 new
DD8.7
dd-trace-js
DataDog
2 CVEs0 on KEV1 new
AA6.5
Android App
Datadog
6 CVEs0 on KEV0 new
DD9.8
dd-trace-java
DataDog
2 CVEs0 on KEV0 new
GU8.2
guarddog
DataDog
2 CVEs0 on KEV0 new
DD7.5
dd-trace-cpp
DataDog
1 CVEs0 on KEV0 new
DD7.5
dd-trace-dotnet
DataDog
1 CVEs0 on KEV0 new
DD7.5
dd-trace-go
DataDog
1 CVEs0 on KEV0 new
DD7.5
dd-trace-php
DataDog
1 CVEs0 on KEV0 new
DD7.5
dd-trace-rb
DataDog
1 CVEs0 on KEV0 new
DD7.5
dd-trace-rs
DataDog
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116693 New | DD dd-trace-js DataDog | 8.7 | Oct 27 | dd-trace: ReDOS in URL query string obfuscation |
| CVE-2026-116589 New | DD dd-trace-py DataDog | 8.2 | Oct 26 | Datadog dd-trace-py: IAST instrumentation can lead to application DOS |
| CVE-2026-116588 New | DD dd-trace-py DataDog | 8.7 | Oct 26 | Datadog dd-trace-py: ReDOS in URL query string obfuscation |
| CVE-2026-50277 | DD dd-trace-cpp DataDog | 7.5 | Sep 17 | dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS |
| CVE-2026-50275 | DD dd-trace-php DataDog | 7.5 | Sep 17 | Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS |
| CVE-2026-50276 | DD dd-trace-rb DataDog | 7.5 | Sep 14 | dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS |
| CVE-2026-50270 | DD dd-trace-java DataDog | 7.5 | Sep 14 | dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS |
| CVE-2026-54788 | DD dd-trace-rs DataDog | 7.5 | Aug 28 | dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS |
| CVE-2026-44965 | AA Android App Datadog | 5.5 | Aug 7 | In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorSavedViewWidgetActivity,… |
| CVE-2026-44964 | AA Android App Datadog | 6.5 | Aug 7 | In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard |
| CVE-2026-47364 | AA Android App Datadog | 6.5 | Aug 7 | In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out |
| CVE-2026-47363 | AA Android App Datadog | 6.3 | Aug 7 | In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from… |
| CVE-2026-47361 | AA Android App Datadog | 6.4 | Aug 7 | In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied… |
| CVE-2026-47362 | AA Android App Datadog | 4.6 | Aug 7 | In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification… |
| CVE-2026-50271 | DD dd-trace-py DataDog | 7.5 | Jul 17 | dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS |
| CVE-2026-50274 | DD dd-trace-go DataDog | 7.5 | Jul 17 | dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS |
| CVE-2026-50272 | DD dd-trace-js DataDog | 7.5 | Jul 17 | dd-trace: Improper parsing of W3C baggage headers may lead to DoS |
| CVE-2026-50273 | DD dd-trace-dotnet DataDog | 7.5 | Jul 17 | Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS |
| CVE-2026-44971 | GU guarddog DataDog | 8.2 | May 27 | GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration |
| CVE-2026-44972 | GU guarddog DataDog | 5.0 | May 27 | GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content |
| CVE-2026-33728 | DD dd-trace-java DataDog | 9.8 | Mar 27 | dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution |