CVE-2026-47364 | Medium | 6.5 | 2026-08-07 | In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out.
… |
CVE-2026-47363 | Medium | 6.3 | 2026-08-07 | In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including… |
CVE-2026-47362 | Medium | 4.6 | 2026-08-07 | In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDat… |
CVE-2026-47361 | Medium | 6.4 | 2026-08-07 | In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a ca… |
CVE-2026-44965 | Medium | 5.5 | 2026-08-07 | In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorSavedViewWidgetActi… |
CVE-2026-44964 | Medium | 6.5 | 2026-08-07 | In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed ap… |
CVE-2026-50274 | High | 7.5 | 2026-07-17 | Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing… |
CVE-2026-50272 | High | 7.5 | 2026-07-17 | dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentra… |
CVE-2026-50271 | High | 7.5 | 2026-07-17 | Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage H… |
CVE-2026-50273 | High | 7.5 | 2026-07-17 | Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagatio… |
CVE-2026-44972 | Medium | 5.0 | 2026-05-27 | GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and… |
CVE-2026-44971 | High | 8.2 | 2026-05-27 | GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled rep… |
CVE-2026-33728 | Critical | 9.8 | 2026-03-27 | dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoi… |
CVE-2026-22871 | Critical | 9.8 | 2026-01-13 | GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() functio… |
CVE-2026-22870 | High | 7.5 | 2026-01-13 | GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompressed file sizes when e… |
CVE-2025-61667 | | | 2025-11-12 | The Datadog Agent collects events and metrics from hosts and sends them to Datadog. A vulnerability within the Datadog Linux Host Agent versions 7.65.0 through… |
CVE-2024-38525 | High | 7.5 | 2024-06-28 | dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited… |
CVE-2023-38704 | High | 8.1 | 2023-08-07 | import-in-the-middle is a module loading interceptor specifically for ESM modules. The import-in-the-middle loader works by generating a wrapper module on the… |
CVE-2022-23531 | Medium | 5.8 | 2022-12-17 | GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted… |
CVE-2022-23530 | Medium | 5.8 | 2022-12-16 | GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted r… |
CVE-2021-21331 | Low | 3.0 | 2021-03-03 | The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the AP… |