{"@context":"https://openvex.dev/ns/v0.2.0","@id":"pkg:docker/agent@7.80.4","author":"security@datadoghq.com","author_role":"Vulnerability Management","last_updated":"2026-08-25T12:26:04.014249502Z","statements":[{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.610423Z","impact_statement":"The product is not affected by CVE-2019-16294 as the vulnerable component SciLexer.dll is not present","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-08-25T11:30:10.610423Z","products":[{"@id":"pkg:generic/scintilla@4.4.6"}],"status":"not_affected","timestamp":"2026-08-25T11:30:10.610423Z","vulnerability":{"name":"CVE-2019-16294"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.615744Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.615744Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.615743Z","vulnerability":{"name":"CVE-2026-14669"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.615818Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.615817Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.615816Z","vulnerability":{"name":"CVE-2026-16239"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.616482Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.616481Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:10.61648Z","vulnerability":{"name":"CVE-2025-50059"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.616528Z","impact_statement":"CVE-2026-6478 is a covert timing-channel vulnerability in the PostgreSQL server's MD5 password-comparison routine during client authentication. The Datadog agent image does not ship or run a PostgreSQL server","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:30:10.616527Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"not_affected","timestamp":"2026-08-25T11:30:10.616527Z","vulnerability":{"name":"CVE-2026-6478"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.61697Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.61697Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.61697Z","vulnerability":{"name":"CVE-2026-14662"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.617009Z","impact_statement":"A server superuser would need to force the agent to call the non-existent lo_read() code path. However no code path in the agent ever calls PQfn() or any lo_* function.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-08-25T11:30:10.617009Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"not_affected","timestamp":"2026-08-25T11:30:10.617009Z","vulnerability":{"name":"CVE-2026-6477"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.617251Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.617251Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.617251Z","vulnerability":{"name":"CVE-2026-14664"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.617301Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.6173Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.6173Z","vulnerability":{"name":"CVE-2026-14670"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.617353Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.617352Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.617352Z","vulnerability":{"name":"CVE-2026-15742"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.617394Z","impact_statement":"CVE-2026-6479 is an uncontrolled recursion vulnerability in the PostgreSQL server-side SSL/GSS connection negotiation path. The Datadog Agent bundle the PostgreSQL client wire-protocol library","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:30:10.617394Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"not_affected","timestamp":"2026-08-25T11:30:10.617394Z","vulnerability":{"name":"CVE-2026-6479"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.617817Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.617817Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.617817Z","vulnerability":{"name":"CVE-2026-19385"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.617869Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.617869Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.617869Z","vulnerability":{"name":"CVE-2026-47057"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.617919Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.617919Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.617919Z","vulnerability":{"name":"CVE-2026-14671"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.617967Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.617967Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.617966Z","vulnerability":{"name":"CVE-2026-14677"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.618027Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.618026Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.618026Z","vulnerability":{"name":"CVE-2026-14680"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.6181Z","impact_statement":"Oracle advisory explicitly excludes server deployments; AWT/JavaFX not used; UI:R unsatisfiable","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T11:30:10.6181Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-08-25T11:30:10.6181Z","vulnerability":{"name":"CVE-2026-21932"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.618229Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.618229Z","products":[{"@id":"pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.618228Z","vulnerability":{"name":"CVE-2026-73500"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.618672Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.618671Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:10.618671Z","vulnerability":{"name":"CVE-2025-30761"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.618719Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.618718Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:10.618718Z","vulnerability":{"name":"CVE-2025-30698"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.619929Z","impact_statement":"CVE-2026-6637 is a stack buffer overflow and SQL injection vulnerability in the PostgreSQL server-side `refint` contrib module, requiring an active PostgreSQL server with `refint` triggers installed to exploit which the Datadog agent does not embed.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:30:10.619929Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"not_affected","timestamp":"2026-08-25T11:30:10.619929Z","vulnerability":{"name":"CVE-2026-6637"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.619977Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.619977Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.619976Z","vulnerability":{"name":"CVE-2026-18408"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.620133Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.620133Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.620132Z","vulnerability":{"name":"CVE-2026-15741"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.620185Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.620185Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.620185Z","vulnerability":{"name":"CVE-2026-6464"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.620226Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.620226Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.620226Z","vulnerability":{"name":"CVE-2026-47058"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.620281Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.620281Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:10.62028Z","vulnerability":{"name":"CVE-2025-53057"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.620332Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.620332Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.620332Z","vulnerability":{"name":"CVE-2026-17084"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.620486Z","impact_statement":"The Datadog Agent does not ship or run a PostgreSQL server","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:30:10.620486Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"not_affected","timestamp":"2026-08-25T11:30:10.620486Z","vulnerability":{"name":"CVE-2026-6475"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.62054Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.62054Z","products":[{"@id":"pkg:pypi/pyasn1@0.6.3"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.62054Z","vulnerability":{"name":"CVE-2026-59884"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.620589Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.620589Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.620589Z","vulnerability":{"name":"CVE-2026-14668"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.620641Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.620641Z","products":[{"@id":"pkg:pypi/pyasn1@0.6.3"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.620641Z","vulnerability":{"name":"CVE-2026-59885"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.620695Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.620695Z","products":[{"@id":"pkg:pypi/pyasn1@0.6.3"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.620695Z","vulnerability":{"name":"CVE-2026-59886"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.621358Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.621358Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:10.621358Z","vulnerability":{"name":"CVE-2026-41254"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.622274Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.622274Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.622274Z","vulnerability":{"name":"CVE-2026-14679"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.622995Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.622995Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.622995Z","vulnerability":{"name":"CVE-2026-15806"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.62318Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.62318Z","products":[{"@id":"pkg:golang/golang.org/x/mod@v0.36.0"},{"@id":"pkg:golang/stdlib@1.25.11"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.62318Z","vulnerability":{"name":"CVE-2026-56864"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.623499Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.623499Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.623498Z","vulnerability":{"name":"CVE-2026-6471"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.623713Z","impact_statement":"This vulnerability detection is a false positive caused by overly broad CPE matching in vulnerability databases. The CVE does not apply to the Windows Datadog Agent.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:30:10.623713Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"not_affected","timestamp":"2026-08-25T11:30:10.623713Z","vulnerability":{"name":"CVE-2017-8806"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.61056Z","impact_statement":"The agent uses Java for JMXFetch which runs only trusted, administrator-installed code to gather metrics from JMX-enabled applications making the exploitation scenario described in this CVE inapplicable to the agent's use case.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T11:30:10.61056Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-08-25T11:30:10.61056Z","vulnerability":{"name":"CVE-2025-30749"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.611066Z","impact_statement":"CVE-2026-6473 is a PostgreSQL **server-side** integer wraparound vulnerability. The Datadog Agent does not ship or run a PostgreSQL server.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:30:10.611066Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"not_affected","timestamp":"2026-08-25T11:30:10.611065Z","vulnerability":{"name":"CVE-2026-6473"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.612158Z","impact_statement":"Oracle's advisory explicitly exempts server-side Java deployments running trusted code and the Datadog Agent JMX fetcher is a server-side process running only the trusted jmxfetch.jar","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T11:30:10.612158Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-08-25T11:30:10.612158Z","vulnerability":{"name":"CVE-2026-21945"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.613143Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.613143Z","products":[{"@id":"pkg:pypi/ddtrace@3.19.5"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.613143Z","vulnerability":{"name":"CVE-2026-50271"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.613197Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.613197Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:10.613196Z","vulnerability":{"name":"CVE-2025-21587"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.613607Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.613607Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:10.613607Z","vulnerability":{"name":"CVE-2026-22016"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.61387Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.61387Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:10.61387Z","vulnerability":{"name":"CVE-2025-50106"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.613925Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.613925Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:10.613925Z","vulnerability":{"name":"CVE-2025-21502"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.61397Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.61397Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:10.61397Z","vulnerability":{"name":"CVE-2025-53066"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.614019Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.614019Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:10.614019Z","vulnerability":{"name":"CVE-2026-34282"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.16135Z","products":[{"@id":"pkg:nuget/Microsoft.WindowsDesktop.App.Runtime.win-x64@9.0.17"}],"status":"affected","timestamp":"2026-08-25T11:30:10.6213Z","vulnerability":{"name":"CVE-2026-62897"}},{"action_statement":"This vulnerability was fixed in: 7.81.1","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:43:37.42044Z","products":[{"@id":"pkg:golang/stdlib@1.25.11"}],"status":"affected","timestamp":"2026-08-25T11:30:10.623759Z","vulnerability":{"name":"CVE-2026-42505"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.623956Z","impact_statement":"The Datadog Agent does not load or run untrusted Java code and is not a sandboxed Java runtime for customer applications. Accordingly, under normal and supported usage, Datadog has identified no viable exploit path for these vulnerabilities","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T11:30:10.623955Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-08-25T11:30:10.623955Z","vulnerability":{"name":"CVE-2025-30754"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.623998Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.623998Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.623998Z","vulnerability":{"name":"CVE-2026-47063"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.62417Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.624169Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.624169Z","vulnerability":{"name":"CVE-2026-19672"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:36:12.933286Z","products":[{"@id":"pkg:pypi/pyjwt@2.12.1"}],"status":"affected","timestamp":"2026-08-25T11:30:10.624057Z","vulnerability":{"name":"CVE-2026-48525"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.624325Z","impact_statement":"The vulnerability is a command injection via newlines in the `poplib` module (Python's POP3 email client library). No agent code uses `poplib`, the agent is an infrastructure monitoring tool with no email/POP3 functionality","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:30:10.624325Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"not_affected","timestamp":"2026-08-25T11:30:10.624325Z","vulnerability":{"name":"CVE-2025-15367"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.62468Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.62468Z","products":[{"@id":"pkg:pypi/pip@26.1.1"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.62468Z","vulnerability":{"name":"CVE-2026-8643"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.625141Z","impact_statement":"This vulnerability cannot be exploited in the Datadog Agent container. MinGit is an unused component from the PowerShell base image with proper ACL protections. The container security model eliminates the attack surface required for exploitation.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T11:30:10.625141Z","products":[{"@id":"pkg:generic/msys2@3.6.7-fb42d71358dd896ab324c52970f7d03f9ab0dfe5"}],"status":"not_affected","timestamp":"2026-08-25T11:30:10.625141Z","vulnerability":{"name":"CVE-2022-37172"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.625187Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.625187Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.625186Z","vulnerability":{"name":"CVE-2026-60147"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.625235Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.625234Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.625234Z","vulnerability":{"name":"CVE-2026-46968"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.625332Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.625332Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:10.625332Z","vulnerability":{"name":"CVE-2026-22021"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.625375Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.625374Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.625374Z","vulnerability":{"name":"CVE-2026-47021"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.625495Z","impact_statement":"The UI:R (user interaction required) prerequisite is structurally unsatisfiable in a containerized agent service, and the attack path described targets sandboxed client deployments","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T11:30:10.625494Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-08-25T11:30:10.625494Z","vulnerability":{"name":"CVE-2026-21933"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.625545Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.625545Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.625545Z","vulnerability":{"name":"CVE-2026-46917"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.62559Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.625589Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.625589Z","vulnerability":{"name":"CVE-2026-47027"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.625639Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.625639Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:10.625639Z","vulnerability":{"name":"CVE-2026-22013"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:10.625906Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:10.625906Z","products":[{"@id":"pkg:pypi/cryptography@46.0.7"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:10.625906Z","vulnerability":{"name":"CVE-2026-69247"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:11.875677Z","impact_statement":"","justification":"component_not_present","last_updated":"2026-08-25T11:30:11.875677Z","products":[{"@id":"pkg:generic/sqlite@3.51.1"},{"@id":"pkg:generic/sqlite@3.43.2"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=sqlite3"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=sqlite3"}],"status":"not_affected","timestamp":"2026-08-25T11:30:11.875676Z","vulnerability":{"name":"CVE-2026-11824"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.922045Z","impact_statement":"","justification":"component_not_present","last_updated":"2026-08-25T11:30:12.922045Z","products":[{"@id":"pkg:generic/sqlite@3.51.1"},{"@id":"pkg:generic/sqlite@3.43.2"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=sqlite3"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=sqlite3"}],"status":"not_affected","timestamp":"2026-08-25T11:30:12.922045Z","vulnerability":{"name":"CVE-2026-11822"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161374Z","products":[{"@id":"pkg:golang/stdlib@1.25.11"}],"status":"affected","timestamp":"2026-08-25T11:30:10.625683Z","vulnerability":{"name":"CVE-2026-56858"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.922165Z","impact_statement":"The vulnerability affects the `mimetypes` module's use of Unix-style paths on Windows. No agent code uses `mimetypes` and no local users exist in the container","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T11:30:12.922164Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"not_affected","timestamp":"2026-08-25T11:30:12.922164Z","vulnerability":{"name":"CVE-2024-3220"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.922558Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.922558Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.922558Z","vulnerability":{"name":"CVE-2026-14672"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.922607Z","impact_statement":"The Datadog Agent does not ship or run a PostgreSQL server","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:30:12.922606Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"not_affected","timestamp":"2026-08-25T11:30:12.922606Z","vulnerability":{"name":"CVE-2026-6638"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.922666Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.922665Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.922665Z","vulnerability":{"name":"CVE-2026-4360"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.923147Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.923147Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:12.923146Z","vulnerability":{"name":"CVE-2026-21925"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.923199Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.923199Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.923199Z","vulnerability":{"name":"CVE-2026-47059"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.923341Z","impact_statement":"The Datadog Agent's Go binary uses Go's standard library `compress/zlib` (pure Go, no linkage to system libz), and Python's `zlib` module, while linking against system libz, does not expose `crc32_combine64` to Python userspace.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T11:30:12.923341Z","products":[{"@id":"pkg:generic/zlib@1.3.1"},{"@id":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=zlib"},{"@id":"pkg:deb/ubuntu/zlib1g@1.3.dfsg-3.1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=zlib"},{"@id":"pkg:deb/ubuntu/zlib1g@1.3.dfsg-3.1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"}],"status":"not_affected","timestamp":"2026-08-25T11:30:12.923341Z","vulnerability":{"name":"CVE-2026-27171"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.923511Z","impact_statement":"The Datadog Agent contains no PostgreSQL server binaries. The agent bundles only the psycopg Python client library and its libpq dependency on Linux builds; the Windows build contains neither","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:30:12.923511Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"not_affected","timestamp":"2026-08-25T11:30:12.92351Z","vulnerability":{"name":"CVE-2026-6474"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.923761Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.923761Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.923761Z","vulnerability":{"name":"CVE-2026-14678"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.923873Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.923873Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.923873Z","vulnerability":{"name":"CVE-2026-18024"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.923938Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.923938Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.923938Z","vulnerability":{"name":"CVE-2026-6470"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.924036Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.924036Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:12.924036Z","vulnerability":{"name":"CVE-2026-22018"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.924148Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.924147Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.924147Z","vulnerability":{"name":"CVE-2026-47010"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.924232Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.924232Z","products":[{"@id":"pkg:golang/golang.org/x/mod@v0.36.0"},{"@id":"pkg:golang/stdlib@1.25.11"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.924232Z","vulnerability":{"name":"CVE-2026-56865"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.924642Z","impact_statement":"This vulnerability lives entirely in PostgreSQL's DDL privilege-checking code and has no client-library component. The Datadog Agent bundles only `libpq` a client wire-protocol library that contains no DDL authorization logic.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:30:12.924642Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"not_affected","timestamp":"2026-08-25T11:30:12.924642Z","vulnerability":{"name":"CVE-2026-6472"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.924702Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.924702Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.924702Z","vulnerability":{"name":"CVE-2026-14666"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.924973Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.924973Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:12.924972Z","vulnerability":{"name":"CVE-2026-23865"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.9251Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.9251Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.9251Z","vulnerability":{"name":"CVE-2026-16241"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.925299Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.925299Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.925299Z","vulnerability":{"name":"CVE-2026-6469"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.925567Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.925567Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.925567Z","vulnerability":{"name":"CVE-2026-14673"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.925627Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.925627Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.925627Z","vulnerability":{"name":"CVE-2026-14663"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.925679Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.925679Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:12.925678Z","vulnerability":{"name":"CVE-2026-22007"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.925743Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.925743Z","products":[{"@id":"pkg:pypi/paramiko@4.0.0"}],"status":"affected","timestamp":"2026-08-25T11:30:12.925743Z","vulnerability":{"name":"CVE-2026-44405"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.92588Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.92588Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T11:30:12.925879Z","vulnerability":{"name":"CVE-2026-34268"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.926587Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.926587Z","products":[{"@id":"pkg:golang/github.com/google/cel-go@v0.27.0"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.926586Z","vulnerability":{"name":"GHSA-gcjh-h69q-9w9g"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.92664Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.92664Z","products":[{"@id":"pkg:pypi/tuf@4.0.0"}],"status":"affected","timestamp":"2026-08-25T11:30:12.92664Z","vulnerability":{"name":"GHSA-qp9x-wp8f-qgjj"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.926683Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.926683Z","products":[{"@id":"pkg:golang/github.com/klauspost/compress@v1.18.6"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.926683Z","vulnerability":{"name":"GO-2026-5841"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.926853Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.926852Z","products":[{"@id":"pkg:golang/golang.org/x/crypto@v0.52.0"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.926852Z","vulnerability":{"name":"GO-2026-5932"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.927013Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.927013Z","products":[{"@id":"pkg:nuget/NuGet.Packaging@6.14.3-rc.1"},{"@id":"pkg:nuget/NuGet.Protocol@6.14.3-rc.1"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.927012Z","vulnerability":{"name":"GHSA-g4vj-cjjj-v7hg"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:12.927084Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:12.927084Z","products":[{"@id":"pkg:pypi/pip@26.1.1"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:12.927084Z","vulnerability":{"name":"PYSEC-2026-3721"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161238Z","products":[{"@id":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64@9.0.17"}],"status":"affected","timestamp":"2026-08-25T11:30:10.611011Z","vulnerability":{"name":"CVE-2026-62898"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161267Z","products":[{"@id":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64@9.0.17"}],"status":"affected","timestamp":"2026-08-25T11:30:10.61147Z","vulnerability":{"name":"CVE-2026-62901"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161353Z","products":[{"@id":"pkg:golang/stdlib@1.25.11"}],"status":"affected","timestamp":"2026-08-25T11:30:10.621406Z","vulnerability":{"name":"CVE-2026-56860"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161356Z","products":[{"@id":"pkg:nuget/Microsoft.WindowsDesktop.App.Runtime.win-x64@9.0.17"}],"status":"affected","timestamp":"2026-08-25T11:30:10.62287Z","vulnerability":{"name":"CVE-2026-70354"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"No agent code uses `imaplib`, the agent is an infrastructure monitoring tool with no email/IMAP functionality","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T12:09:52.16136Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"affected","timestamp":"2026-08-25T11:30:10.623535Z","vulnerability":{"name":"CVE-2025-15366"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161364Z","products":[{"@id":"pkg:nuget/System.Security.Cryptography.Xml@9.0.16"},{"@id":"pkg:nuget/System.Security.Cryptography.Xml@9.0.17"}],"status":"affected","timestamp":"2026-08-25T11:30:10.624883Z","vulnerability":{"name":"CVE-2026-47304"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161378Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"affected","timestamp":"2026-08-25T11:30:12.923562Z","vulnerability":{"name":"CVE-2026-6879"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161386Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"affected","timestamp":"2026-08-25T11:30:12.92476Z","vulnerability":{"name":"CVE-2026-12003"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161394Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"affected","timestamp":"2026-08-25T11:30:12.925367Z","vulnerability":{"name":"CVE-2026-0864"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161398Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"affected","timestamp":"2026-08-25T11:30:12.925952Z","vulnerability":{"name":"CVE-2026-18503"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161402Z","products":[{"@id":"pkg:golang/google.golang.org/grpc@v1.81.0"}],"status":"affected","timestamp":"2026-08-25T11:30:12.926289Z","vulnerability":{"name":"GHSA-hrxh-6v49-42gf"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:00:54.746894Z","products":[{"@id":"pkg:golang/golang.org/x/text@v0.37.0"}],"status":"affected","timestamp":"2026-08-25T11:30:10.617056Z","vulnerability":{"name":"CVE-2026-56852"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:00:54.746933Z","products":[{"@id":"pkg:golang/github.com/containerd/containerd@v1.7.32"}],"status":"affected","timestamp":"2026-08-25T11:30:10.618149Z","vulnerability":{"name":"CVE-2026-53492"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:00:54.746939Z","products":[{"@id":"pkg:golang/github.com/containerd/containerd@v1.7.32"}],"status":"affected","timestamp":"2026-08-25T11:30:10.620067Z","vulnerability":{"name":"CVE-2026-50195"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:00:54.746947Z","products":[{"@id":"pkg:golang/go.mongodb.org/mongo-driver@v1.17.6"}],"status":"affected","timestamp":"2026-08-25T11:30:12.922479Z","vulnerability":{"name":"CVE-2026-2303"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:00:54.746951Z","products":[{"@id":"pkg:golang/github.com/containerd/containerd@v1.7.32"}],"status":"affected","timestamp":"2026-08-25T11:30:12.9234Z","vulnerability":{"name":"CVE-2026-53489"}},{"action_statement":"This vulnerability was fixed in: 7.81.1","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:43:37.420378Z","products":[{"@id":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64@9.0.17"}],"status":"affected","timestamp":"2026-08-25T11:30:10.612563Z","vulnerability":{"name":"CVE-2026-50651"}},{"action_statement":"This vulnerability was fixed in: 7.81.1","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:43:37.420409Z","products":[{"@id":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64@9.0.17"}],"status":"affected","timestamp":"2026-08-25T11:30:10.614422Z","vulnerability":{"name":"CVE-2026-50524"}},{"action_statement":"This vulnerability was fixed in: 7.81.1","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:43:37.420414Z","products":[{"@id":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64@9.0.17"}],"status":"affected","timestamp":"2026-08-25T11:30:10.615686Z","vulnerability":{"name":"CVE-2026-50528"}},{"action_statement":"This vulnerability was fixed in: 7.81.1","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:43:37.420423Z","products":[{"@id":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64@9.0.17"}],"status":"affected","timestamp":"2026-08-25T11:30:10.618618Z","vulnerability":{"name":"CVE-2026-50659"}},{"action_statement":"This vulnerability was fixed in: 7.81.1","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:43:37.420431Z","products":[{"@id":"pkg:nuget/Microsoft.WindowsDesktop.App.Runtime.win-x64@9.0.17"}],"status":"affected","timestamp":"2026-08-25T11:30:10.622207Z","vulnerability":{"name":"CVE-2026-50650"}},{"action_statement":"This vulnerability was fixed in: 7.81.1","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:43:37.420434Z","products":[{"@id":"pkg:pypi/setuptools@82.0.1"}],"status":"affected","timestamp":"2026-08-25T11:30:10.622941Z","vulnerability":{"name":"CVE-2026-59890"}},{"action_statement":"This vulnerability was fixed in: 7.81.1","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:43:37.420444Z","products":[{"@id":"pkg:golang/stdlib@1.25.11"}],"status":"affected","timestamp":"2026-08-25T11:30:10.624476Z","vulnerability":{"name":"CVE-2026-39822"}},{"action_statement":"This vulnerability was fixed in: 7.81.1","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"This is a false positive. The Datadog Agent vendors containerd v1.7.32 solely as a read-only client library (listing containers, subscribing to events, reading image metadata for SBOM generation) and never calls the vulnerable container-creation APIs, as the Agent does not create containers. The containerd library will be patched in newer versions.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:43:37.420447Z","products":[{"@id":"pkg:golang/github.com/containerd/containerd@v1.7.32"}],"status":"affected","timestamp":"2026-08-25T11:30:10.625266Z","vulnerability":{"name":"CVE-2026-47262"}},{"action_statement":"This vulnerability was fixed in: 7.81.1","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"False positive, this vulnerability affects containerd's CRI plugin. The Datadog Agent embeds containerd@v1.7.32 solely as a client library to query a host's containerd daemon, it does not run the CRI plugin server or any plugin that consumes container labels.  The patch will be available in version 7.81.x of the agent.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:43:37.420452Z","products":[{"@id":"pkg:golang/github.com/containerd/containerd@v1.7.32"}],"status":"affected","timestamp":"2026-08-25T11:30:12.922325Z","vulnerability":{"name":"CVE-2026-53488"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"The Datadog Agent uses libpq exclusively as a client library for database connections; it does not host a PostgreSQL server or load server extensions","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:36:12.933233Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"affected","timestamp":"2026-08-25T11:30:10.61046Z","vulnerability":{"name":"CVE-2026-2005"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"The Datadog Agent uses libpq exclusively as a client library for database connections; it does not host a PostgreSQL server or load server extensions","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:36:12.933256Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"affected","timestamp":"2026-08-25T11:30:10.610493Z","vulnerability":{"name":"CVE-2026-2004"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"The Datadog Agent uses libpq exclusively as a client library for database connections; it does not host a PostgreSQL server or load server extensions","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:36:12.933262Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"affected","timestamp":"2026-08-25T11:30:10.610525Z","vulnerability":{"name":"CVE-2026-2006"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"The detected artifact (`libpq.dll`) is the PostgreSQL client connection library bundled with the psycopg3 binary wheel and does not contain the vulnerable dump/restore code","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:36:12.933269Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"affected","timestamp":"2026-08-25T11:30:10.613089Z","vulnerability":{"name":"CVE-2025-8714"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"The detected artifact (`libpq.dll`) is the PostgreSQL client connection library bundled with the psycopg3 binary wheel and does not contain the vulnerable dump/restore code","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:36:12.933277Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"affected","timestamp":"2026-08-25T11:30:10.618066Z","vulnerability":{"name":"CVE-2025-8715"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"The agent uses PyJWT exclusively to sign JWTs (jwt.encode). It never decodes or verifies JWTs in production code. The CVE requires a verifier that accepts both asymmetric and HMAC algorithms simultaneously, that code path does not exist in the shipped agent. A patch that fixes this issue will be available in v7.81.x of the Datadog agent.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-08-25T11:36:12.933281Z","products":[{"@id":"pkg:pypi/pyjwt@2.12.1"}],"status":"affected","timestamp":"2026-08-25T11:30:10.620016Z","vulnerability":{"name":"CVE-2026-48526"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"The agent uses libpq solely as an outbound client with no inbound libpq exposure.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T11:36:12.933289Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"affected","timestamp":"2026-08-25T11:30:10.624101Z","vulnerability":{"name":"CVE-2025-12818"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:36:12.933293Z","products":[{"@id":"pkg:golang/go.opentelemetry.io/otel@v1.43.0"}],"status":"affected","timestamp":"2026-08-25T11:30:10.624752Z","vulnerability":{"name":"CVE-2026-41178"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:36:12.933299Z","products":[{"@id":"pkg:pypi/cryptography@46.0.7"}],"status":"affected","timestamp":"2026-08-25T11:30:10.62546Z","vulnerability":{"name":"CVE-2026-69249"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161272Z","products":[{"@id":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64@9.0.17"},{"@id":"pkg:nuget/System.Security.Cryptography.Xml@9.0.16"},{"@id":"pkg:nuget/System.Security.Cryptography.Xml@9.0.17"}],"status":"affected","timestamp":"2026-08-25T11:30:10.611894Z","vulnerability":{"name":"CVE-2026-47302"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"The Datadog Agent uses libpq as a client only and does not host PostgreSQL server code.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:36:12.933304Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"affected","timestamp":"2026-08-25T11:30:12.922381Z","vulnerability":{"name":"CVE-2026-2003"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161277Z","products":[{"@id":"pkg:nuget/System.Security.Cryptography.Xml@9.0.16"},{"@id":"pkg:nuget/System.Security.Cryptography.Xml@9.0.17"}],"status":"affected","timestamp":"2026-08-25T11:30:10.612615Z","vulnerability":{"name":"CVE-2026-50527"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.16128Z","products":[{"@id":"pkg:nuget/System.Security.Cryptography.Xml@9.0.16"},{"@id":"pkg:nuget/System.Security.Cryptography.Xml@9.0.17"}],"status":"affected","timestamp":"2026-08-25T11:30:10.612671Z","vulnerability":{"name":"CVE-2026-50648"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161285Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"affected","timestamp":"2026-08-25T11:30:10.613244Z","vulnerability":{"name":"CVE-2026-11940"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.16129Z","products":[{"@id":"pkg:golang/stdlib@1.25.11"}],"status":"affected","timestamp":"2026-08-25T11:30:10.613411Z","vulnerability":{"name":"CVE-2026-39821"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161293Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"affected","timestamp":"2026-08-25T11:30:10.613663Z","vulnerability":{"name":"CVE-2026-15308"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:36:12.933313Z","products":[{"@id":"pkg:pypi/pyjwt@2.12.1"}],"status":"affected","timestamp":"2026-08-25T11:30:12.92297Z","vulnerability":{"name":"CVE-2026-48524"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:36:12.933316Z","products":[{"@id":"pkg:pypi/cryptography@46.0.7"}],"status":"affected","timestamp":"2026-08-25T11:30:12.923076Z","vulnerability":{"name":"CVE-2026-69248"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161297Z","products":[{"@id":"pkg:nuget/System.Security.Cryptography.Xml@9.0.16"},{"@id":"pkg:nuget/System.Security.Cryptography.Xml@9.0.17"}],"status":"affected","timestamp":"2026-08-25T11:30:10.614472Z","vulnerability":{"name":"CVE-2026-50525"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:36:12.933319Z","products":[{"@id":"pkg:pypi/pyjwt@2.12.1"}],"status":"affected","timestamp":"2026-08-25T11:30:12.923257Z","vulnerability":{"name":"CVE-2026-48522"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"CVE-2025-12817 is a server-side PostgreSQL CREATE STATISTICS missing authorization flaw. The Datadog Agent does not ship a PostgreSQL server","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:36:12.933326Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"affected","timestamp":"2026-08-25T11:30:12.925038Z","vulnerability":{"name":"CVE-2025-12817"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161299Z","products":[{"@id":"pkg:nuget/Microsoft.WindowsDesktop.App.Runtime.win-x64@9.0.17"}],"status":"affected","timestamp":"2026-08-25T11:30:10.615284Z","vulnerability":{"name":"CVE-2026-62902"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"No PostgreSQL server binary exists in the image.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:36:12.933328Z","products":[{"@id":"pkg:generic/postgresql@16.9"}],"status":"affected","timestamp":"2026-08-25T11:30:12.925145Z","vulnerability":{"name":"CVE-2025-8713"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:36:12.933331Z","products":[{"@id":"pkg:pypi/pyjwt@2.12.1"}],"status":"affected","timestamp":"2026-08-25T11:30:12.925212Z","vulnerability":{"name":"CVE-2026-48523"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161313Z","products":[{"@id":"pkg:golang/stdlib@1.25.11"}],"status":"affected","timestamp":"2026-08-25T11:30:10.615866Z","vulnerability":{"name":"CVE-2026-33818"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161316Z","products":[{"@id":"pkg:golang/stdlib@1.25.11"}],"status":"affected","timestamp":"2026-08-25T11:30:10.616084Z","vulnerability":{"name":"CVE-2026-56853"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.16132Z","products":[{"@id":"pkg:golang/stdlib@1.25.11"}],"status":"affected","timestamp":"2026-08-25T11:30:10.61629Z","vulnerability":{"name":"CVE-2026-56859"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161324Z","products":[{"@id":"pkg:golang/golang.org/x/net@v0.55.0"},{"@id":"pkg:golang/stdlib@1.25.11"}],"status":"affected","timestamp":"2026-08-25T11:30:10.616582Z","vulnerability":{"name":"CVE-2026-46600"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161328Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"affected","timestamp":"2026-08-25T11:30:10.617443Z","vulnerability":{"name":"CVE-2026-11972"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161332Z","products":[{"@id":"pkg:golang/stdlib@1.25.11"}],"status":"affected","timestamp":"2026-08-25T11:30:10.6176Z","vulnerability":{"name":"CVE-2026-56862"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161337Z","products":[{"@id":"pkg:nuget/Microsoft.WindowsDesktop.App.Runtime.win-x64@9.0.17"}],"status":"affected","timestamp":"2026-08-25T11:30:10.619311Z","vulnerability":{"name":"CVE-2026-62886"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"False positive. The cryptography package is used only for parsing an X.509 certificate structure to check expiry/validity and for RSA request signing (APIC auth). All the advisories linked to the OpenSSL version used in the cryptography do not apply to the agent context.  The cryptography library will also be patched in the 7.81.x release of the agent.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:36:12.933336Z","products":[{"@id":"pkg:pypi/cryptography@46.0.7"}],"status":"affected","timestamp":"2026-08-25T11:30:12.926194Z","vulnerability":{"name":"GHSA-537c-gmf6-5ccf"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:09:52.161345Z","products":[{"@id":"pkg:nuget/Microsoft.WindowsDesktop.App.Runtime.win-x64@9.0.17"}],"status":"affected","timestamp":"2026-08-25T11:30:10.619898Z","vulnerability":{"name":"CVE-2026-62871"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:36:12.933339Z","products":[{"@id":"pkg:pypi/setuptools@75.1.0?catalog_name=setuptools3\u0026download_url=https%3A%2F%2Fgithub.com%2Fpypa%2Fsetuptools%2Farchive%2Fv75.1.0.tar.gz\u0026checksum=sha256:514dc60688d3118c9883a3dd54a38b28128ea912c01ea325d6e204a93da3b524"}],"status":"affected","timestamp":"2026-08-25T11:30:12.926966Z","vulnerability":{"name":"CVE-2025-47273"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:36:12.933355Z","products":[{"@id":"pkg:pypi/setuptools@75.1.0?catalog_name=setuptools3\u0026download_url=https%3A%2F%2Fgithub.com%2Fpypa%2Fsetuptools%2Farchive%2Fv75.1.0.tar.gz\u0026checksum=sha256:514dc60688d3118c9883a3dd54a38b28128ea912c01ea325d6e204a93da3b524"}],"status":"affected","timestamp":"2026-08-25T11:30:12.927151Z","vulnerability":{"name":"GHSA-h35f-9h28-mq5c"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:27.975306Z","impact_statement":"CVE-2025-6965 is a memory corruption vulnerability in SQLite \u003c 3.50.2. The Datadog Windows agent image is not vulnerable: the embedded CPython build is explicitly pinned to SQLite 3.53.0, and the Go SQLite modules (mattn/go-sqlite3, modernc.org/sqlite, glebarez/go-sqlite) are gated behind LINUX_ONLY_TAGS and are never compiled into Windows builds. The only winsqlite3.dll present belongs to the Windows Server 2019 OS base layer which is never loaded by the agent process","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:30:27.975306Z","products":[{"@id":"pkg:generic/sqlite@3.43.2"}],"status":"not_affected","timestamp":"2026-08-25T11:30:27.975306Z","vulnerability":{"name":"CVE-2025-6965"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:30:28.000532Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:30:28.000532Z","products":[{"@id":"pkg:generic/sqlite@3.43.2"}],"status":"under_investigation","timestamp":"2026-08-25T11:30:28.000532Z","vulnerability":{"name":"CVE-2025-70873"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.658704Z","impact_statement":"CVE-2018-10126 represents ZERO security risk to the Datadog Agent running on Ubuntu 24.04. Both Ubuntu and Debian security teams have assessed this as having no security impact, and the vulnerability cannot be reproduced in modern versions of the software.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T11:34:38.658704Z","products":[{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=libjpeg-turbo"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=libjpeg-turbo"}],"status":"not_affected","timestamp":"2026-08-25T11:34:38.658704Z","vulnerability":{"name":"CVE-2018-10126"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.659262Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.659262Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"under_investigation","timestamp":"2026-08-25T11:34:38.659262Z","vulnerability":{"name":"CVE-2026-14456"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.55522Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.658474Z","vulnerability":{"name":"CVE-2026-11586"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555223Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.658657Z","vulnerability":{"name":"CVE-2026-11856"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555227Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.658809Z","vulnerability":{"name":"CVE-2026-11564"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.55523Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.659122Z","vulnerability":{"name":"CVE-2026-8924"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555238Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.659217Z","vulnerability":{"name":"CVE-2026-9546"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.660982Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.660982Z","products":[{"@id":"pkg:deb/ubuntu/libgcrypt20@1.10.3-2ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libgcrypt20@1.10.3-2ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.660982Z","vulnerability":{"name":"CVE-2024-2236"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555242Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.660375Z","vulnerability":{"name":"CVE-2026-8927"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555245Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.660431Z","vulnerability":{"name":"CVE-2026-9080"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555248Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.660923Z","vulnerability":{"name":"CVE-2026-8926"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.661517Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.661517Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-08-25T11:34:38.661517Z","vulnerability":{"name":"CVE-2026-57433"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555283Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.661732Z","vulnerability":{"name":"CVE-2026-12064"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.662496Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.662496Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-08-25T11:34:38.662496Z","vulnerability":{"name":"CVE-2026-70906"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555294Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.662079Z","vulnerability":{"name":"CVE-2026-9547"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555297Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.662126Z","vulnerability":{"name":"CVE-2026-8286"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.662658Z","impact_statement":"CVE-2026-9538 is a memory-exhaustion denial-of-service in Perl's Archive::Tar module. The Datadog Agent image ships only perl-base, the stripped-down Perl interpreter with no optional modules, and does not install the full perl or perl-modules packages that contain Archive::Tar.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:34:38.662658Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"not_affected","timestamp":"2026-08-25T11:34:38.662658Z","vulnerability":{"name":"CVE-2026-9538"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.66318Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.66318Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-08-25T11:34:38.66318Z","vulnerability":{"name":"CVE-2026-13221"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.663289Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.663289Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-08-25T11:34:38.663288Z","vulnerability":{"name":"CVE-2026-19487"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.663434Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.663434Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-08-25T11:34:38.663433Z","vulnerability":{"name":"CVE-2026-7017"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.663711Z","impact_statement":"The ffmpeg-related packages identified in the scan are transitive dependencies introduced through the browser components used by the Synthetics worker. They are not directly invoked by Datadog application code, but are installed as part of the underlying operating system and Chrome dependencies required for browser-based test execution.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-08-25T11:34:38.663711Z","products":[{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"}],"status":"not_affected","timestamp":"2026-08-25T11:34:38.663711Z","vulnerability":{"name":"CVE-2025-1352"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.664057Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.664056Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-08-25T11:34:38.664056Z","vulnerability":{"name":"CVE-2026-12087"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.664155Z","impact_statement":"CVE-2026-48959 is a CPU exhaustion vulnerability in the Perl module IO::Uncompress::Unzip. The Agent ships only perl-base, the minimal Ubuntu Perl runtime, and does not install the libio-compress-perl package.","justification":"component_not_present","last_updated":"2026-08-25T11:34:38.664154Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"not_affected","timestamp":"2026-08-25T11:34:38.664154Z","vulnerability":{"name":"CVE-2026-48959"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.665952Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.665951Z","products":[{"@id":"pkg:deb/ubuntu/diffutils@1%3A3.10-1build1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/diffutils@3.10-1build1?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/diffutils@1%3A3.10-1build1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/diffutils@3.10-1build1?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"}],"status":"affected","timestamp":"2026-08-25T11:34:38.665951Z","vulnerability":{"name":"CVE-2026-53910"}},{"action_statement":"This vulnerability was fixed in: 7.81.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:59:41.750141Z","products":[{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.5?arch=all\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.5?arch=all\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"}],"status":"affected","timestamp":"2026-08-25T11:34:38.66539Z","vulnerability":{"name":"CVE-2026-54411"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.666585Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.666585Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-08-25T11:34:38.666585Z","vulnerability":{"name":"CVE-2026-61308"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.666854Z","impact_statement":"The image ships only perl-base, a stripped-down package that provides only the bare Perl runtime needed by system init scripts, without any CPAN modules","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:34:38.666853Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"not_affected","timestamp":"2026-08-25T11:34:38.666853Z","vulnerability":{"name":"CVE-2026-48962"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.667488Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.667488Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-08-25T11:34:38.667488Z","vulnerability":{"name":"CVE-2026-70907"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.667859Z","impact_statement":"While the vulnerable libpam0g package is present in the Datadog Agent's Ubuntu base image, the Agent does not use PAM for authentication operations, making this vulnerability not exploitable in the Agent's context.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T11:34:38.667859Z","products":[{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.5?arch=all\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.5?arch=all\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"}],"status":"not_affected","timestamp":"2026-08-25T11:34:38.667859Z","vulnerability":{"name":"CVE-2024-10041"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.668127Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.668126Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-08-25T11:34:38.668126Z","vulnerability":{"name":"CVE-2026-60589"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.668344Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.668344Z","products":[{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.668344Z","vulnerability":{"name":"CVE-2016-2781"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.668563Z","impact_statement":"While the vulnerable shadow-utils version is present, the critical exploitation tool (newuidmap) is NOT installed, making the vulnerability unexploitable. Additionally, container architecture eliminates all prerequisite conditions for exploitation.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:34:38.668563Z","products":[{"@id":"pkg:deb/ubuntu/login@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/login@4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/passwd@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/passwd@4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/login@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/login@4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/passwd@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/passwd@4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"}],"status":"not_affected","timestamp":"2026-08-25T11:34:38.668563Z","vulnerability":{"name":"CVE-2024-56433"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.669076Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.669076Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-08-25T11:34:38.669076Z","vulnerability":{"name":"CVE-2016-20013"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.66936Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.66936Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-08-25T11:34:38.66936Z","vulnerability":{"name":"CVE-2026-57432"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.669462Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.669462Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-08-25T11:34:38.669461Z","vulnerability":{"name":"CVE-2026-6791"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.669858Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.669858Z","products":[{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"}],"status":"affected","timestamp":"2026-08-25T11:34:38.669858Z","vulnerability":{"name":"CVE-2025-1376"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.669938Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.669938Z","products":[{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"}],"status":"affected","timestamp":"2026-08-25T11:34:38.669937Z","vulnerability":{"name":"CVE-2022-3219"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.670377Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.670377Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-08-25T11:34:38.670377Z","vulnerability":{"name":"CVE-2026-15534"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.67065Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.67065Z","products":[{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.67065Z","vulnerability":{"name":"CVE-2026-56392"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.67071Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.67071Z","products":[{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=acl"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=acl"}],"status":"affected","timestamp":"2026-08-25T11:34:38.67071Z","vulnerability":{"name":"CVE-2026-54369"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.670803Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.670803Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.670803Z","vulnerability":{"name":"CVE-2026-13595"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.671802Z","impact_statement":"No Datadog Agent runtime code path invokes `sort` with any of the CVE conditions: all Go `sort` references are the in-memory standard library package, and the only system `sort` calls exist in build-time-only install scripts using simple `-r`/`-rn` flags on static, hardcoded inputs. Debian classifies this as \"unimportant\" (\"Crash in CLI tool, no security impact\") and Ubuntu as Low priority.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:34:38.671801Z","products":[{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"not_affected","timestamp":"2026-08-25T11:34:38.671801Z","vulnerability":{"name":"CVE-2025-5278"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.671875Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.671875Z","products":[{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=p11-kit"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=p11-kit"}],"status":"affected","timestamp":"2026-08-25T11:34:38.671874Z","vulnerability":{"name":"CVE-2026-13757"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.67196Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.671959Z","products":[{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.671959Z","vulnerability":{"name":"CVE-2026-56391"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.672023Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.672023Z","products":[{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.672023Z","vulnerability":{"name":"CVE-2026-18508"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.672148Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.672148Z","products":[{"@id":"pkg:deb/ubuntu/libattr1@1%3A2.5.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=attr"},{"@id":"pkg:deb/ubuntu/libattr1@2.5.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libattr1@1%3A2.5.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=attr"},{"@id":"pkg:deb/ubuntu/libattr1@2.5.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"}],"status":"affected","timestamp":"2026-08-25T11:34:38.672148Z","vulnerability":{"name":"CVE-2026-54371"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.672285Z","impact_statement":"The Datadog Agent image embeds only perl-base and does not install libio-compress-perl or perl-modules.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:34:38.672285Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"not_affected","timestamp":"2026-08-25T11:34:38.672284Z","vulnerability":{"name":"CVE-2025-15649"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.672601Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.672601Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.6726Z","vulnerability":{"name":"CVE-2026-27456"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.673633Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.673633Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-08-25T11:34:38.673633Z","vulnerability":{"name":"CVE-2026-6368"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.673829Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.673829Z","products":[{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=p11-kit"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=p11-kit"}],"status":"affected","timestamp":"2026-08-25T11:34:38.673829Z","vulnerability":{"name":"CVE-2026-18938"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.67389Z","impact_statement":"The Datadog Agent ships only libsystemd0, a shared utility library for client-side systemd APIs such as sd_notify. The journald daemon binary is entirely absent from the image.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:34:38.67389Z","products":[{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"}],"status":"not_affected","timestamp":"2026-08-25T11:34:38.67389Z","vulnerability":{"name":"CVE-2026-40228"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.674004Z","impact_statement":"tic is a terminfo compiler, a build/development tool that the Datadog Agent never invokes. It has no reverse dependencies in the image and the agent's runtime dependency graph never calls it. The vulnerable code path in postprocess_termcap is only reachable by running tic with a crafted input file, which the agent process never does.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-08-25T11:34:38.674004Z","products":[{"@id":"pkg:deb/ubuntu/libncursesw6@6.4%2B20240113-1ubuntu2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libncursesw6@6.4%2B20240113-1ubuntu2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/libtinfo6@6.4%2B20240113-1ubuntu2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libtinfo6@6.4%2B20240113-1ubuntu2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/ncurses-base@6.4%2B20240113-1ubuntu2?arch=all\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/ncurses-base@6.4%2B20240113-1ubuntu2?arch=all\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/ncurses-bin@6.4%2B20240113-1ubuntu2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/ncurses-bin@6.4%2B20240113-1ubuntu2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/libncursesw6@6.4%2B20240113-1ubuntu2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libncursesw6@6.4%2B20240113-1ubuntu2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/libtinfo6@6.4%2B20240113-1ubuntu2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libtinfo6@6.4%2B20240113-1ubuntu2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/ncurses-bin@6.4%2B20240113-1ubuntu2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/ncurses-bin@6.4%2B20240113-1ubuntu2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"}],"status":"not_affected","timestamp":"2026-08-25T11:34:38.674004Z","vulnerability":{"name":"CVE-2025-6141"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.674235Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.674235Z","products":[{"@id":"pkg:golang/github.com/cilium/ebpf@v0.21.0"}],"status":"under_investigation","timestamp":"2026-08-25T11:34:38.674235Z","vulnerability":{"name":"CVE-2026-10722"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.674296Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.674296Z","products":[{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=acl"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=acl"}],"status":"affected","timestamp":"2026-08-25T11:34:38.674296Z","vulnerability":{"name":"CVE-2026-54370"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.674379Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.674379Z","products":[{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"}],"status":"affected","timestamp":"2026-08-25T11:34:38.674378Z","vulnerability":{"name":"CVE-2026-57062"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.674475Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.674475Z","products":[{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.674474Z","vulnerability":{"name":"CVE-2026-18477"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.674516Z","impact_statement":"The Datadog Agent performs bzip2 decompression exclusively through Go's built-in compress/bzip2 standard library package, a pure Go implementation that makes no calls to libbz2 or any system bzip2 binary.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:34:38.674515Z","products":[{"@id":"pkg:deb/ubuntu/libbz2-1.0@1.0.8-5.1build0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libbz2-1.0@1.0.8-5.1build0.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=bzip2"},{"@id":"pkg:deb/ubuntu/libbz2-1.0@1.0.8-5.1build0.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libbz2-1.0@1.0.8-5.1build0.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=bzip2"}],"status":"not_affected","timestamp":"2026-08-25T11:34:38.674515Z","vulnerability":{"name":"CVE-2026-42250"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.674916Z","impact_statement":"While libbpf1 version 1.3.0-2build2 is installed and IS vulnerable, the Datadog Agent does not use libbpf. Additionally, the vulnerability is disputed by maintainers as it requires root privileges to trigger.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T11:34:38.674916Z","products":[{"@id":"pkg:deb/ubuntu/libbpf1@1.3.0-2build2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libbpf1@1%3A1.3.0-2build2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=libbpf%401.3.0-2build2"},{"@id":"pkg:deb/ubuntu/libbpf1@1.3.0-2build2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libbpf1@1%3A1.3.0-2build2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=libbpf%401.3.0-2build2"}],"status":"not_affected","timestamp":"2026-08-25T11:34:38.674915Z","vulnerability":{"name":"CVE-2025-29481"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.675173Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.675173Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.675173Z","vulnerability":{"name":"CVE-2026-53612"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.67526Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.67526Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.67526Z","vulnerability":{"name":"CVE-2026-53613"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.67534Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.675339Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.675339Z","vulnerability":{"name":"CVE-2026-53614"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.675419Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.675419Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.675419Z","vulnerability":{"name":"CVE-2026-53615"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.678937Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.678937Z","products":[{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.11?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.11?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.11?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.11?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.11?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.11?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.678936Z","vulnerability":{"name":"CVE-2026-75803"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.679354Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.679353Z","products":[{"@id":"pkg:golang/github.com/aws/aws-sdk-go@v1.55.8"}],"status":"affected","timestamp":"2026-08-25T11:34:38.679353Z","vulnerability":{"name":"GO-2022-0635"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:34:38.679389Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.679389Z","products":[{"@id":"pkg:golang/github.com/aws/aws-sdk-go@v1.55.8"}],"status":"affected","timestamp":"2026-08-25T11:34:38.679389Z","vulnerability":{"name":"GO-2022-0646"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.863973Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"fixed","timestamp":"2026-08-25T11:34:38.863972Z","vulnerability":{"name":"CVE-2026-8376"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.863996Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"fixed","timestamp":"2026-08-25T11:34:38.863996Z","vulnerability":{"name":"CVE-2026-42496"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.864002Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"fixed","timestamp":"2026-08-25T11:34:38.864002Z","vulnerability":{"name":"CVE-2026-42497"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.864012Z","products":[{"@id":"pkg:deb/ubuntu/libnss3@2%3A3.98-1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=nss"},{"@id":"pkg:deb/ubuntu/libnss3@3.98-1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=2"},{"@id":"pkg:deb/ubuntu/libnss3@2%3A3.98-1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=nss"},{"@id":"pkg:deb/ubuntu/libnss3@3.98-1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=2"}],"status":"fixed","timestamp":"2026-08-25T11:34:38.864012Z","vulnerability":{"name":"CVE-2026-12318"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:34:38.864034Z","products":[{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3build1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3build1?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"fixed","timestamp":"2026-08-25T11:34:38.864034Z","vulnerability":{"name":"USN-8477-1"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:27.831865Z","products":[{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"}],"status":"affected","timestamp":"2026-08-25T11:34:38.672452Z","vulnerability":{"name":"CVE-2026-15059"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:27.831877Z","products":[{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"}],"status":"affected","timestamp":"2026-08-25T11:34:38.67471Z","vulnerability":{"name":"CVE-2026-16742"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:04:43.928683Z","products":[{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.11?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.11?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.679433Z","vulnerability":{"name":"USN-8625-1"}},{"action_statement":"This vulnerability was fixed in: 7.81.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"The agent codebase is primarily Go which does not invoke glibc's stdio scanner, and all embedded C binaries and shared libraries do not contain occurrences of the %mc pattern. There is no reachable code path through which an attacker could supply input to the vulnerable glibc branch","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-08-25T11:59:41.750079Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-08-25T11:34:38.661912Z","vulnerability":{"name":"CVE-2026-5450"}},{"action_statement":"This vulnerability was fixed in: 7.81.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:59:41.750111Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-08-25T11:34:38.663808Z","vulnerability":{"name":"CVE-2026-4046"}},{"action_statement":"This vulnerability was fixed in: 7.81.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:59:41.750125Z","products":[{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.664254Z","vulnerability":{"name":"CVE-2026-5704"}},{"action_statement":"This vulnerability was fixed in: 7.81.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"The agent's primary runtime (Go) does not use glibc wide character I/O functions, all Python processes run exclusively with UTF-8 encoding (which the NVD advisory explicitly excludes from the data-disclosure path)","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:59:41.750131Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-08-25T11:34:38.664395Z","vulnerability":{"name":"CVE-2026-5928"}},{"action_statement":"This vulnerability was fixed in: 7.81.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:59:41.750137Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-08-25T11:34:38.664614Z","vulnerability":{"name":"CVE-2026-6238"}},{"action_statement":"This vulnerability was fixed in: 7.81.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:59:41.750146Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-08-25T11:34:38.666044Z","vulnerability":{"name":"CVE-2026-4437"}},{"action_statement":"This vulnerability was fixed in: 7.81.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:59:41.750149Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-08-25T11:34:38.666236Z","vulnerability":{"name":"CVE-2026-4438"}},{"action_statement":"This vulnerability was fixed in: 7.81.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:59:41.750156Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-08-25T11:34:38.668882Z","vulnerability":{"name":"CVE-2026-5435"}},{"action_statement":"This vulnerability was fixed in: 7.81.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:52:42.313778Z","products":[{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=sqlite3"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=sqlite3"}],"status":"affected","timestamp":"2026-08-25T11:34:38.670483Z","vulnerability":{"name":"CVE-2026-50812"}},{"action_statement":"This vulnerability was fixed in: 7.81.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:52:42.313806Z","products":[{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=sqlite3"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=sqlite3"}],"status":"affected","timestamp":"2026-08-25T11:34:38.670559Z","vulnerability":{"name":"CVE-2026-50813"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555172Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.65825Z","vulnerability":{"name":"CVE-2026-8925"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555203Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.658309Z","vulnerability":{"name":"CVE-2026-9079"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555207Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.658374Z","vulnerability":{"name":"CVE-2026-10536"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555217Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.658417Z","vulnerability":{"name":"CVE-2026-11352"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555257Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.661186Z","vulnerability":{"name":"CVE-2026-8458"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555272Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.661238Z","vulnerability":{"name":"CVE-2026-9545"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555275Z","products":[{"@id":"pkg:generic/curl@8.20.0"}],"status":"affected","timestamp":"2026-08-25T11:34:38.661309Z","vulnerability":{"name":"CVE-2026-8932"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"Given the low risk of this vulnerability, since it requires repeated use of the system tar binary and the agent neither invokes /usr/bin/tar nor relies on it for archive handling, instead using Go’s safe archive/tar implementation with path protections, we propose to wait for an official fix from the vendor.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T11:40:50.555301Z","products":[{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.663106Z","vulnerability":{"name":"CVE-2025-45582"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555326Z","products":[{"@id":"pkg:deb/ubuntu/gzip@1.12-1ubuntu3.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gzip@1.12-1ubuntu3.1?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.665331Z","vulnerability":{"name":"CVE-2026-41992"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"infocmp is never invoked by the Datadog Agent at runtime. The attack requires local access, attacker-controlled terminfo entries, and user interaction.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T11:40:50.55534Z","products":[{"@id":"pkg:deb/ubuntu/libncursesw6@6.4%2B20240113-1ubuntu2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libncursesw6@6.4%2B20240113-1ubuntu2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/libtinfo6@6.4%2B20240113-1ubuntu2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libtinfo6@6.4%2B20240113-1ubuntu2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/ncurses-base@6.4%2B20240113-1ubuntu2?arch=all\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/ncurses-base@6.4%2B20240113-1ubuntu2?arch=all\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/ncurses-bin@6.4%2B20240113-1ubuntu2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/ncurses-bin@6.4%2B20240113-1ubuntu2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/libncursesw6@6.4%2B20240113-1ubuntu2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libncursesw6@6.4%2B20240113-1ubuntu2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/libtinfo6@6.4%2B20240113-1ubuntu2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libtinfo6@6.4%2B20240113-1ubuntu2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/ncurses-bin@6.4%2B20240113-1ubuntu2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/ncurses-bin@6.4%2B20240113-1ubuntu2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"}],"status":"affected","timestamp":"2026-08-25T11:34:38.667614Z","vulnerability":{"name":"CVE-2025-69720"}},{"action_statement":"This vulnerability was fixed in: 7.81.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:40:50.555365Z","products":[{"@id":"pkg:deb/ubuntu/gzip@1.12-1ubuntu3.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gzip@1.12-1ubuntu3.1?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:34:38.673567Z","vulnerability":{"name":"CVE-2026-41991"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:08:25.166713Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:38:42.921625Z","vulnerability":{"name":"CVE-2026-48095"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:08:25.166748Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:38:42.924493Z","vulnerability":{"name":"CVE-2026-14266"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"The Datadog Agent has no MimeKit dependency and sends no SMTP mail","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T12:08:25.16674Z","products":[{"@id":"pkg:nuget/MimeKit@4.3.0.0"}],"status":"affected","timestamp":"2026-08-25T11:38:42.923179Z","vulnerability":{"name":"CVE-2026-30227"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:08:25.166783Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:38:42.934553Z","vulnerability":{"name":"CVE-2026-48092"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:08:25.166787Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:38:42.936369Z","vulnerability":{"name":"CVE-2026-48101"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:08:25.166789Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:38:42.936715Z","vulnerability":{"name":"CVE-2026-48112"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:08:25.166793Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:38:42.936819Z","vulnerability":{"name":"CVE-2026-48103"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:08:25.166798Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:38:42.936895Z","vulnerability":{"name":"CVE-2026-48111"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:08:25.16683Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:38:46.030558Z","vulnerability":{"name":"CVE-2026-58052"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:08:25.166823Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:38:46.030349Z","vulnerability":{"name":"CVE-2026-48104"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:08:25.166827Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:38:46.030417Z","vulnerability":{"name":"CVE-2026-48102"}},{"action_statement":"This vulnerability was fixed in: 7.82.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"The agent does not perform S/MIME message processing or X.509 certificate imports via email libraries","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T12:08:25.166835Z","products":[{"@id":"pkg:nuget/MimeKit@4.3.0.0"}],"status":"affected","timestamp":"2026-08-25T11:38:46.031719Z","vulnerability":{"name":"GHSA-gmc6-fwg3-75m5"}}],"timestamp":"2026-07-01T12:57:34.078981988Z","tooling":"","version":32}