Skip to content
Datadog vulnerabilities
Newest
-
datadog dd-trace-js
dd-trace: ReDOS in URL query string obfuscation
CVE-2026-116693
Fix available
8.7 High
-
datadog dd-trace-py
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
CVE-2026-116589
Fix available
8.2 High
-
datadog dd-trace-py
Datadog dd-trace-py: ReDOS in URL query string obfuscation
CVE-2026-116588
Fix available
8.7 High
-
datadog dd-trace-cpp
dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50277
7.5 High
-
datadog dd-trace-php
Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50275
7.5 High
-
datadog dd-trace-rs
dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS
CVE-2026-54788
Fix available
7.5 High
-
datadog android app
On every successful login, the Datadog Android application calls FirebaseCrashlytics.setUserId...
CVE-2026-47364
6.5 Medium
-
datadog android app
The launcher activity AppActivity in the Datadog Android application is declared android:exported...
CVE-2026-47363
6.3 Medium
-
datadog android app
Six Android App Widget configuration activities in the Datadog Android application are declared...
CVE-2026-44965
5.5 Medium
-
datadog android app
The OnCallNotificationActivity in the Datadog Android application is declared android:exported=...
CVE-2026-44964
6.5 Medium
-
datadog android app
The Datadog Android application stores operationally sensitive content in plaintext SQLite...
CVE-2026-47362
4.6 Medium
-
datadog android app
BubbleChatActivity in the Datadog Android application is declared android:exported="true" with no...
CVE-2026-47361
6.4 Medium
-
datadog dd-trace-rb
dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50276
Fix available
7.5 High
-
datadog dd-trace-go
dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50274
Fix available
7.5 High
-
datadog dd-trace-dotnet
Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50273
Fix available
7.5 High
-
datadog dd-trace-js
dd-trace: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50272
Fix available
7.5 High
-
datadog dd-trace-py
dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50271
Fix available
7.5 High
-
datadog dd-trace-java, com.datadoghq dd-java-agent +1 more
dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50270
Fix available
7.5 High
-
datadog guarddog
GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
CVE-2026-44971
8.2 High
-
datadog guarddog
GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content
CVE-2026-44972
5.0 Medium
-
datadog dd-trace-java
dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution
CVE-2026-33728
Fix available
9.3 Critical
-
datadog guarddog
GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
CVE-2026-22871
Fix available
8.7 High
-
datadog guarddog
GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS
CVE-2026-22870
Fix available
7.1 High
-
datadog datadog-agent
Datadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissions
CVE-2025-61667
7.0 High
-
datadog dd-trace-cpp
dd-trace-cpp malformed unicode header values may cause crash
CVE-2024-38525
7.5 High
-
datadog import-in-the-middle
import-in-the-middle allows unsanitized user controlled input in module generation
CVE-2023-38704
Fix available
8.1 High
-
datadog guarddog
GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package
CVE-2022-23530
Fix available
5.8 Medium
-
datadog guarddog
Arbitrary file write when scanning a specially-crafted local PyPI package
CVE-2022-23531
Fix available
5.8 Medium
-
datadog datadog-api-client-java
DataDog API Client contains a Local Information Disclosure Vulnerability
CVE-2021-21331
Fix available
3.0 Low