# cve.now: Datadog

The newest entries naming Datadog as an affected vendor (up to 200), of 29 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-116693](https://cve.now/CVE-2026-116693.md): dd-trace: ReDOS in URL query string obfuscation (CVSS 8.7)
- [CVE-2026-116589](https://cve.now/CVE-2026-116589.md): Datadog dd-trace-py: IAST instrumentation can lead to application DOS (CVSS 8.2)
- [CVE-2026-116588](https://cve.now/CVE-2026-116588.md): Datadog dd-trace-py: ReDOS in URL query string obfuscation (CVSS 8.7)
- [CVE-2026-50277](https://cve.now/CVE-2026-50277.md): dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5)
- [CVE-2026-50275](https://cve.now/CVE-2026-50275.md): Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5)
- [CVE-2026-50276](https://cve.now/CVE-2026-50276.md): dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5)
- [CVE-2026-50270](https://cve.now/CVE-2026-50270.md): dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5)
- [CVE-2026-54788](https://cve.now/CVE-2026-54788.md): dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS (CVSS 7.5)
- [CVE-2026-44965](https://cve.now/CVE-2026-44965.md): In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, Monitor (CVSS 5.5)
- [CVE-2026-44964](https://cve.now/CVE-2026-44964.md): In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard (CVSS 6.5)
- [CVE-2026-47364](https://cve.now/CVE-2026-47364.md): In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user (CVSS 6.5)
- [CVE-2026-47363](https://cve.now/CVE-2026-47363.md): In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied (CVSS 6.3)
- [CVE-2026-47361](https://cve.now/CVE-2026-47361.md): In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SE (CVSS 6.4)
- [CVE-2026-47362](https://cve.now/CVE-2026-47362.md): In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: L (CVSS 4.6)
- [CVE-2026-50271](https://cve.now/CVE-2026-50271.md): dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5)
- [CVE-2026-50274](https://cve.now/CVE-2026-50274.md): dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5)
- [CVE-2026-50272](https://cve.now/CVE-2026-50272.md): dd-trace: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5)
- [CVE-2026-50273](https://cve.now/CVE-2026-50273.md): Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5)
- [CVE-2026-44971](https://cve.now/CVE-2026-44971.md): GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and \`GH\_TOKEN\` exfiltration (CVSS 8.2)
- [CVE-2026-44972](https://cve.now/CVE-2026-44972.md): GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content (CVSS 5.0)
- [CVE-2026-33728](https://cve.now/CVE-2026-33728.md): dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution (CVSS 9.3)
- [CVE-2026-22871](https://cve.now/CVE-2026-22871.md): GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE (CVSS 8.7)
- [CVE-2026-22870](https://cve.now/CVE-2026-22870.md): GuardDog Zip Bomb Vulnerability in safe\_extract() Allows DoS (CVSS 7.1)
- [CVE-2025-61667](https://cve.now/CVE-2025-61667.md): Datadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissions (CVSS 7.0)
- [CVE-2024-38525](https://cve.now/CVE-2024-38525.md): dd-trace-cpp malformed unicode header values may cause crash (CVSS 7.5)
- [CVE-2023-38704](https://cve.now/CVE-2023-38704.md): import-in-the-middle allows unsanitized user controlled input in module generation (CVSS 8.1)
- [CVE-2022-23531](https://cve.now/CVE-2022-23531.md): Arbitrary file write when scanning a specially-crafted local PyPI package (CVSS 5.8)
- [CVE-2022-23530](https://cve.now/CVE-2022-23530.md): GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package (CVSS 5.8)
- [CVE-2021-21331](https://cve.now/CVE-2021-21331.md): DataDog API Client contains a Local Information Disclosure Vulnerability (CVSS 3.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/datadog
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.