{"@context":"https://openvex.dev/ns/v0.2.0","@id":"pkg:docker/agent@7.82.0","author":"security@datadoghq.com","author_role":"Vulnerability Management","last_updated":"2026-08-25T12:24:53.011576941Z","statements":[{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.05708Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.05708Z","products":[{"@id":"pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.11"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.05708Z","vulnerability":{"name":"CVE-2026-73500"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.057146Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.057146Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:01:57.057145Z","vulnerability":{"name":"CVE-2025-30761"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.057205Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.057205Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:01:57.057205Z","vulnerability":{"name":"CVE-2025-30698"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.058463Z","impact_statement":"CVE-2026-6637 is a stack buffer overflow and SQL injection vulnerability in the PostgreSQL server-side `refint` contrib module, requiring an active PostgreSQL server with `refint` triggers installed to exploit which the Datadog agent does not embed.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T12:01:57.058463Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-08-25T12:01:57.058462Z","vulnerability":{"name":"CVE-2026-6637"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.058517Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.058517Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.058516Z","vulnerability":{"name":"CVE-2026-18408"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.058595Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.058595Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.058594Z","vulnerability":{"name":"CVE-2026-15741"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.05865Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.05865Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.05865Z","vulnerability":{"name":"CVE-2026-6464"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.058712Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.058712Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.058711Z","vulnerability":{"name":"CVE-2026-47058"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.058786Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.058785Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:01:57.058785Z","vulnerability":{"name":"CVE-2025-53057"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.058849Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.058849Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.058849Z","vulnerability":{"name":"CVE-2026-17084"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.059087Z","impact_statement":"The Datadog Agent does not ship or run a PostgreSQL server","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T12:01:57.059086Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-08-25T12:01:57.059086Z","vulnerability":{"name":"CVE-2026-6475"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.059138Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.059138Z","products":[{"@id":"pkg:pypi/pyasn1@0.6.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.059138Z","vulnerability":{"name":"CVE-2026-59884"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.059201Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.059201Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.059201Z","vulnerability":{"name":"CVE-2026-14668"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.059267Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.059267Z","products":[{"@id":"pkg:pypi/pyasn1@0.6.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.059267Z","vulnerability":{"name":"CVE-2026-59885"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.059324Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.059324Z","products":[{"@id":"pkg:pypi/pyasn1@0.6.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.059324Z","vulnerability":{"name":"CVE-2026-59886"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.060048Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.060048Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:01:57.060047Z","vulnerability":{"name":"CVE-2026-41254"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.06037Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.060369Z","products":[{"@id":"pkg:generic/sqlite@3.43.2"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.060369Z","vulnerability":{"name":"CVE-2025-70873"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.060459Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.060459Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.060459Z","vulnerability":{"name":"CVE-2026-14679"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.061148Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.061148Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.061148Z","vulnerability":{"name":"CVE-2026-15806"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.061376Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.061376Z","products":[{"@id":"pkg:golang/golang.org/x/mod@v0.37.0"},{"@id":"pkg:golang/stdlib@1.26.5"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.061376Z","vulnerability":{"name":"CVE-2026-56864"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.061826Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.061826Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.061826Z","vulnerability":{"name":"CVE-2026-6476"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.061892Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.061891Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.061891Z","vulnerability":{"name":"CVE-2026-6471"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.062135Z","impact_statement":"This vulnerability detection is a false positive caused by overly broad CPE matching in vulnerability databases. The CVE does not apply to the Windows Datadog Agent.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T12:01:57.062135Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-08-25T12:01:57.062135Z","vulnerability":{"name":"CVE-2017-8806"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.062176Z","impact_statement":"The Datadog Agent does not load or run untrusted Java code and is not a sandboxed Java runtime for customer applications. Accordingly, under normal and supported usage, Datadog has identified no viable exploit path for these vulnerabilities","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T12:01:57.062176Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-08-25T12:01:57.062176Z","vulnerability":{"name":"CVE-2025-30754"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.062231Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.062231Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.06223Z","vulnerability":{"name":"CVE-2026-47063"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.062325Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.062325Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.062325Z","vulnerability":{"name":"CVE-2026-19672"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.062521Z","impact_statement":"The vulnerability is a command injection via newlines in the `poplib` module (Python's POP3 email client library). No agent code uses `poplib`, the agent is an infrastructure monitoring tool with no email/POP3 functionality","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T12:01:57.062521Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"not_affected","timestamp":"2026-08-25T12:01:57.062521Z","vulnerability":{"name":"CVE-2025-15367"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.062711Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.062711Z","products":[{"@id":"pkg:pypi/pip@26.1.1"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.062711Z","vulnerability":{"name":"CVE-2026-8643"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.06286Z","impact_statement":"This vulnerability cannot be exploited in the Datadog Agent container. MinGit is an unused component from the PowerShell base image with proper ACL protections. The container security model eliminates the attack surface required for exploitation.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T12:01:57.06286Z","products":[{"@id":"pkg:generic/msys2@3.6.9-b4195d69133078c498a1bf811c4fb0c61fc3c8af"}],"status":"not_affected","timestamp":"2026-08-25T12:01:57.06286Z","vulnerability":{"name":"CVE-2022-37172"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.062921Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.062921Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.062921Z","vulnerability":{"name":"CVE-2026-60147"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.062976Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.062976Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.062976Z","vulnerability":{"name":"CVE-2026-46968"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.063034Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.063034Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:01:57.063034Z","vulnerability":{"name":"CVE-2026-22021"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.051468Z","impact_statement":"CVE-2025-6965 is a memory corruption vulnerability in SQLite \u003c 3.50.2. The Datadog Windows agent image is not vulnerable: the embedded CPython build is explicitly pinned to SQLite 3.53.0, and the Go SQLite modules (mattn/go-sqlite3, modernc.org/sqlite, glebarez/go-sqlite) are gated behind LINUX_ONLY_TAGS and are never compiled into Windows builds. The only winsqlite3.dll present belongs to the Windows Server 2019 OS base layer which is never loaded by the agent process","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T12:01:57.051468Z","products":[{"@id":"pkg:generic/sqlite@3.43.2"}],"status":"not_affected","timestamp":"2026-08-25T12:01:57.051467Z","vulnerability":{"name":"CVE-2025-6965"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.05156Z","impact_statement":"The product is not affected by CVE-2019-16294 as the vulnerable component SciLexer.dll is not present","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-08-25T12:01:57.05156Z","products":[{"@id":"pkg:generic/scintilla@4.4.6"}],"status":"not_affected","timestamp":"2026-08-25T12:01:57.05156Z","vulnerability":{"name":"CVE-2019-16294"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.051602Z","impact_statement":"The agent uses Java for JMXFetch which runs only trusted, administrator-installed code to gather metrics from JMX-enabled applications making the exploitation scenario described in this CVE inapplicable to the agent's use case.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T12:01:57.051602Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-08-25T12:01:57.051601Z","vulnerability":{"name":"CVE-2025-30749"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.052123Z","impact_statement":"CVE-2026-6473 is a PostgreSQL **server-side** integer wraparound vulnerability. The Datadog Agent does not ship or run a PostgreSQL server.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T12:01:57.052123Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-08-25T12:01:57.052123Z","vulnerability":{"name":"CVE-2026-6473"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.052616Z","impact_statement":"Oracle's advisory explicitly exempts server-side Java deployments running trusted code and the Datadog Agent JMX fetcher is a server-side process running only the trusted jmxfetch.jar","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T12:01:57.052616Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-08-25T12:01:57.052616Z","vulnerability":{"name":"CVE-2026-21945"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.052816Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.052816Z","products":[{"@id":"pkg:pypi/ddtrace@3.19.5"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.052816Z","vulnerability":{"name":"CVE-2026-50271"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.052874Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.052874Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:01:57.052874Z","vulnerability":{"name":"CVE-2025-21587"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.053401Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.0534Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:01:57.0534Z","vulnerability":{"name":"CVE-2026-22016"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.063078Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.063078Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.063076Z","vulnerability":{"name":"CVE-2026-47021"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.063124Z","impact_statement":"The UI:R (user interaction required) prerequisite is structurally unsatisfiable in a containerized agent service, and the attack path described targets sandboxed client deployments","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T12:01:57.063124Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-08-25T12:01:57.063124Z","vulnerability":{"name":"CVE-2026-21933"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.063173Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.063173Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.063173Z","vulnerability":{"name":"CVE-2026-46917"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.05367Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.05367Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:01:57.05367Z","vulnerability":{"name":"CVE-2025-50106"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.053714Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.053714Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:01:57.053714Z","vulnerability":{"name":"CVE-2025-21502"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.0538Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.0538Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:01:57.053799Z","vulnerability":{"name":"CVE-2025-53066"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.05386Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.05386Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:01:57.05386Z","vulnerability":{"name":"CVE-2026-34282"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.054566Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.054566Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.054566Z","vulnerability":{"name":"CVE-2026-14669"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.054633Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.054632Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.054632Z","vulnerability":{"name":"CVE-2026-16239"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.055428Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.055428Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:01:57.055428Z","vulnerability":{"name":"CVE-2025-50059"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.055478Z","impact_statement":"CVE-2026-6478 is a covert timing-channel vulnerability in the PostgreSQL server's MD5 password-comparison routine during client authentication. The Datadog agent image does not ship or run a PostgreSQL server","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T12:01:57.055477Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-08-25T12:01:57.055477Z","vulnerability":{"name":"CVE-2026-6478"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.055831Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.055815Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.055813Z","vulnerability":{"name":"CVE-2026-14662"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.055888Z","impact_statement":"A server superuser would need to force the agent to call the non-existent lo_read() code path. However no code path in the agent ever calls PQfn() or any lo_* function.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-08-25T12:01:57.055888Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-08-25T12:01:57.055887Z","vulnerability":{"name":"CVE-2026-6477"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.055943Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.055943Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.055943Z","vulnerability":{"name":"CVE-2026-14664"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.055993Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.055992Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.055992Z","vulnerability":{"name":"CVE-2026-14670"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.056057Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.056057Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.056057Z","vulnerability":{"name":"CVE-2026-15742"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.056096Z","impact_statement":"CVE-2026-6479 is an uncontrolled recursion vulnerability in the PostgreSQL server-side SSL/GSS connection negotiation path. The Datadog Agent bundle the PostgreSQL client wire-protocol library","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T12:01:57.056096Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-08-25T12:01:57.056096Z","vulnerability":{"name":"CVE-2026-6479"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.056608Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.056608Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.056608Z","vulnerability":{"name":"CVE-2026-14676"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.056662Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.056662Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.056662Z","vulnerability":{"name":"CVE-2026-19385"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.056718Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.056718Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.056718Z","vulnerability":{"name":"CVE-2026-47057"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.056803Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.056803Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.056802Z","vulnerability":{"name":"CVE-2026-14671"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.056852Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.056852Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.056852Z","vulnerability":{"name":"CVE-2026-14677"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.056922Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.056922Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.056922Z","vulnerability":{"name":"CVE-2026-14680"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.056992Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.056992Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.056991Z","vulnerability":{"name":"CVE-2026-16238"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.057025Z","impact_statement":"Oracle advisory explicitly excludes server deployments; AWT/JavaFX not used; UI:R unsatisfiable","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T12:01:57.057025Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-08-25T12:01:57.057024Z","vulnerability":{"name":"CVE-2026-21932"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.063241Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.063241Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.063241Z","vulnerability":{"name":"CVE-2026-47027"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.063313Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.063313Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:01:57.063313Z","vulnerability":{"name":"CVE-2026-22013"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:01:57.063619Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:01:57.063618Z","products":[{"@id":"pkg:pypi/cryptography@48.0.1"}],"status":"under_investigation","timestamp":"2026-08-25T12:01:57.063618Z","vulnerability":{"name":"CVE-2026-69247"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:01.13165Z","impact_statement":"the embedded CPython sqlite3.dll (which has FTS5 compiled in) and the mattn/go-sqlite3 amalgamation used by the podman/trivy/sbom collectors — is already built from SQLite \u003e3.53.2, the exact release that contains the fix. The one dependency in go.mod that does embed a pre-fix SQLite (modernc.org/sqlite v1.49.1, SQLite \u003e3.53.0) is an indirect, never-imported module","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T12:02:01.13165Z","products":[{"@id":"pkg:generic/sqlite@3.43.2"},{"@id":"pkg:generic/sqlite@3.51.1"}],"status":"not_affected","timestamp":"2026-08-25T12:02:01.131649Z","vulnerability":{"name":"CVE-2026-11824"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.723133Z","impact_statement":"","justification":"component_not_present","last_updated":"2026-08-25T12:02:03.723133Z","products":[{"@id":"pkg:generic/sqlite@3.43.2"},{"@id":"pkg:generic/sqlite@3.51.1"}],"status":"not_affected","timestamp":"2026-08-25T12:02:03.723132Z","vulnerability":{"name":"CVE-2026-11822"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.72334Z","impact_statement":"The vulnerability affects the `mimetypes` module's use of Unix-style paths on Windows. No agent code uses `mimetypes` and no local users exist in the container","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T12:02:03.72334Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"not_affected","timestamp":"2026-08-25T12:02:03.72334Z","vulnerability":{"name":"CVE-2024-3220"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.723581Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.72358Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.72358Z","vulnerability":{"name":"CVE-2026-14672"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.723645Z","impact_statement":"The Datadog Agent does not ship or run a PostgreSQL server","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T12:02:03.723645Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-08-25T12:02:03.723645Z","vulnerability":{"name":"CVE-2026-6638"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.72371Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.723709Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.723709Z","vulnerability":{"name":"CVE-2026-4360"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.724005Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.724005Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:02:03.724004Z","vulnerability":{"name":"CVE-2026-21925"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.724061Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.724061Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.724061Z","vulnerability":{"name":"CVE-2026-47059"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.724169Z","impact_statement":"The Datadog Agent's Go binary uses Go's standard library `compress/zlib` (pure Go, no linkage to system libz), and Python's `zlib` module, while linking against system libz, does not expose `crc32_combine64` to Python userspace.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T12:02:03.724169Z","products":[{"@id":"pkg:generic/zlib@1.3.1"},{"@id":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=zlib"},{"@id":"pkg:deb/ubuntu/zlib1g@1.3.dfsg-3.1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=zlib"},{"@id":"pkg:deb/ubuntu/zlib1g@1.3.dfsg-3.1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"}],"status":"not_affected","timestamp":"2026-08-25T12:02:03.724169Z","vulnerability":{"name":"CVE-2026-27171"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.724221Z","impact_statement":"The Datadog Agent contains no PostgreSQL server binaries. The agent bundles only the psycopg Python client library and its libpq dependency on Linux builds; the Windows build contains neither","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T12:02:03.724221Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-08-25T12:02:03.72422Z","vulnerability":{"name":"CVE-2026-6474"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.724283Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.724283Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.724283Z","vulnerability":{"name":"CVE-2026-6575"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.724625Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.724625Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.724625Z","vulnerability":{"name":"CVE-2026-14678"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.724725Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.724724Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.724724Z","vulnerability":{"name":"CVE-2026-18024"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.724827Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.724826Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.724826Z","vulnerability":{"name":"CVE-2026-6470"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.724883Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.724883Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:02:03.724883Z","vulnerability":{"name":"CVE-2026-22018"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.724937Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.724937Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.724936Z","vulnerability":{"name":"CVE-2026-47010"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.724989Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.724989Z","products":[{"@id":"pkg:golang/golang.org/x/mod@v0.37.0"},{"@id":"pkg:golang/stdlib@1.26.5"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.724989Z","vulnerability":{"name":"CVE-2026-56865"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.725409Z","impact_statement":"This vulnerability lives entirely in PostgreSQL's DDL privilege-checking code and has no client-library component. The Datadog Agent bundles only `libpq` a client wire-protocol library that contains no DDL authorization logic.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T12:02:03.725409Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-08-25T12:02:03.725409Z","vulnerability":{"name":"CVE-2026-6472"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.725467Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.725466Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.725466Z","vulnerability":{"name":"CVE-2026-14666"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.72581Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.72581Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:02:03.72581Z","vulnerability":{"name":"CVE-2026-23865"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.725902Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.725902Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.725902Z","vulnerability":{"name":"CVE-2026-16241"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.725995Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.725995Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.725994Z","vulnerability":{"name":"CVE-2026-6469"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.726407Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.726407Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.726407Z","vulnerability":{"name":"CVE-2026-14673"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.726511Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.726511Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.726511Z","vulnerability":{"name":"CVE-2026-14663"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.726564Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.726564Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:02:03.726564Z","vulnerability":{"name":"CVE-2026-22007"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.726615Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.726614Z","products":[{"@id":"pkg:pypi/paramiko@4.0.0"}],"status":"affected","timestamp":"2026-08-25T12:02:03.726614Z","vulnerability":{"name":"CVE-2026-44405"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.726665Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.726665Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-08-25T12:02:03.726665Z","vulnerability":{"name":"CVE-2026-34268"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.727011Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.727011Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.727011Z","vulnerability":{"name":"CVE-2026-14681"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.727353Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.727353Z","products":[{"@id":"pkg:golang/github.com/google/cel-go@v0.28.1"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.727353Z","vulnerability":{"name":"GHSA-gcjh-h69q-9w9g"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.72741Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.72741Z","products":[{"@id":"pkg:pypi/tuf@4.0.0"}],"status":"affected","timestamp":"2026-08-25T12:02:03.72741Z","vulnerability":{"name":"GHSA-qp9x-wp8f-qgjj"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.727451Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.727451Z","products":[{"@id":"pkg:golang/github.com/klauspost/compress@v1.18.6"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.727451Z","vulnerability":{"name":"GO-2026-5841"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.727599Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.727599Z","products":[{"@id":"pkg:golang/golang.org/x/crypto@v0.54.0"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.727599Z","vulnerability":{"name":"GO-2026-5932"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.727683Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.727683Z","products":[{"@id":"pkg:nuget/NuGet.Packaging@6.14.3-rc.1"},{"@id":"pkg:nuget/NuGet.Protocol@6.14.3-rc.1"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.727683Z","vulnerability":{"name":"GHSA-g4vj-cjjj-v7hg"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.727753Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.727752Z","products":[{"@id":"pkg:pypi/cryptography@48.0.1"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.727752Z","vulnerability":{"name":"GHSA-jwv3-5hgf-82ww"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.727814Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.727813Z","products":[{"@id":"pkg:pypi/cryptography@48.0.1"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.727813Z","vulnerability":{"name":"GHSA-m2h6-j472-rp4c"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.727854Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.727853Z","products":[{"@id":"pkg:cargo/h2@0.4.14"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.727853Z","vulnerability":{"name":"RUSTSEC-2026-0258"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T12:02:03.727899Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:03.727899Z","products":[{"@id":"pkg:pypi/pip@26.1.1"}],"status":"under_investigation","timestamp":"2026-08-25T12:02:03.727898Z","vulnerability":{"name":"PYSEC-2026-3721"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:04.041027Z","products":[{"@id":"pkg:golang/golang.org/x/text@v0.37.0"}],"status":"fixed","timestamp":"2026-08-25T12:02:04.041027Z","vulnerability":{"name":"CVE-2026-56852"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:04.04106Z","products":[{"@id":"pkg:golang/github.com/containerd/containerd@v1.7.33"}],"status":"fixed","timestamp":"2026-08-25T12:02:04.04106Z","vulnerability":{"name":"CVE-2026-53492"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:04.041065Z","products":[{"@id":"pkg:golang/github.com/containerd/containerd@v1.7.33"}],"status":"fixed","timestamp":"2026-08-25T12:02:04.041064Z","vulnerability":{"name":"CVE-2026-50195"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:04.041073Z","products":[{"@id":"pkg:golang/go.mongodb.org/mongo-driver@v1.17.6"}],"status":"fixed","timestamp":"2026-08-25T12:02:04.041073Z","vulnerability":{"name":"CVE-2026-2303"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:02:04.041077Z","products":[{"@id":"pkg:golang/github.com/containerd/containerd@v1.7.33"}],"status":"fixed","timestamp":"2026-08-25T12:02:04.041077Z","vulnerability":{"name":"CVE-2026-53489"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998756Z","products":[{"@id":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64@9.0.18"}],"status":"affected","timestamp":"2026-08-25T12:01:57.052052Z","vulnerability":{"name":"CVE-2026-62898"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998825Z","products":[{"@id":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64@9.0.18"}],"status":"affected","timestamp":"2026-08-25T12:01:57.052519Z","vulnerability":{"name":"CVE-2026-62901"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998831Z","products":[{"@id":"pkg:nuget/System.Security.Cryptography.Xml@9.0.17"}],"status":"affected","timestamp":"2026-08-25T12:01:57.052577Z","vulnerability":{"name":"CVE-2026-47302"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998838Z","products":[{"@id":"pkg:nuget/System.Security.Cryptography.Xml@9.0.17"}],"status":"affected","timestamp":"2026-08-25T12:01:57.052682Z","vulnerability":{"name":"CVE-2026-50527"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998841Z","products":[{"@id":"pkg:nuget/System.Security.Cryptography.Xml@9.0.17"}],"status":"affected","timestamp":"2026-08-25T12:01:57.052733Z","vulnerability":{"name":"CVE-2026-50648"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998845Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"affected","timestamp":"2026-08-25T12:01:57.052938Z","vulnerability":{"name":"CVE-2026-11940"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998852Z","products":[{"@id":"pkg:golang/stdlib@1.26.5"}],"status":"affected","timestamp":"2026-08-25T12:01:57.053158Z","vulnerability":{"name":"CVE-2026-39821"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.99886Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"affected","timestamp":"2026-08-25T12:01:57.05347Z","vulnerability":{"name":"CVE-2026-15308"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998875Z","products":[{"@id":"pkg:nuget/System.Security.Cryptography.Xml@9.0.17"}],"status":"affected","timestamp":"2026-08-25T12:01:57.053912Z","vulnerability":{"name":"CVE-2026-50525"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998878Z","products":[{"@id":"pkg:nuget/Microsoft.WindowsDesktop.App.Runtime.win-x64@9.0.18"}],"status":"affected","timestamp":"2026-08-25T12:01:57.054507Z","vulnerability":{"name":"CVE-2026-62902"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998882Z","products":[{"@id":"pkg:golang/stdlib@1.26.5"}],"status":"affected","timestamp":"2026-08-25T12:01:57.054692Z","vulnerability":{"name":"CVE-2026-33818"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998885Z","products":[{"@id":"pkg:golang/stdlib@1.26.5"}],"status":"affected","timestamp":"2026-08-25T12:01:57.054955Z","vulnerability":{"name":"CVE-2026-56853"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998888Z","products":[{"@id":"pkg:golang/stdlib@1.26.5"}],"status":"affected","timestamp":"2026-08-25T12:01:57.055204Z","vulnerability":{"name":"CVE-2026-56859"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998891Z","products":[{"@id":"pkg:golang/stdlib@1.26.5"}],"status":"affected","timestamp":"2026-08-25T12:01:57.055525Z","vulnerability":{"name":"CVE-2026-46600"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998896Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"affected","timestamp":"2026-08-25T12:01:57.05617Z","vulnerability":{"name":"CVE-2026-11972"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998994Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"affected","timestamp":"2026-08-25T12:02:03.726087Z","vulnerability":{"name":"CVE-2026-0864"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998998Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"affected","timestamp":"2026-08-25T12:02:03.726725Z","vulnerability":{"name":"CVE-2026-18503"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.999001Z","products":[{"@id":"pkg:golang/google.golang.org/grpc@v1.82.0"}],"status":"affected","timestamp":"2026-08-25T12:02:03.727066Z","vulnerability":{"name":"GHSA-hrxh-6v49-42gf"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998942Z","products":[{"@id":"pkg:golang/stdlib@1.26.5"}],"status":"affected","timestamp":"2026-08-25T12:01:57.05635Z","vulnerability":{"name":"CVE-2026-56862"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998951Z","products":[{"@id":"pkg:nuget/Microsoft.WindowsDesktop.App.Runtime.win-x64@9.0.18"}],"status":"affected","timestamp":"2026-08-25T12:01:57.057807Z","vulnerability":{"name":"CVE-2026-62886"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998954Z","products":[{"@id":"pkg:nuget/Microsoft.WindowsDesktop.App.Runtime.win-x64@9.0.18"}],"status":"affected","timestamp":"2026-08-25T12:01:57.058415Z","vulnerability":{"name":"CVE-2026-62871"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998959Z","products":[{"@id":"pkg:nuget/Microsoft.WindowsDesktop.App.Runtime.win-x64@9.0.18"}],"status":"affected","timestamp":"2026-08-25T12:01:57.05997Z","vulnerability":{"name":"CVE-2026-62897"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998962Z","products":[{"@id":"pkg:golang/stdlib@1.26.5"}],"status":"affected","timestamp":"2026-08-25T12:01:57.060115Z","vulnerability":{"name":"CVE-2026-56860"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998964Z","products":[{"@id":"pkg:nuget/Microsoft.WindowsDesktop.App.Runtime.win-x64@9.0.18"}],"status":"affected","timestamp":"2026-08-25T12:01:57.061068Z","vulnerability":{"name":"CVE-2026-70354"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"No agent code uses `imaplib`, the agent is an infrastructure monitoring tool with no email/IMAP functionality","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T12:13:20.998967Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"affected","timestamp":"2026-08-25T12:01:57.061947Z","vulnerability":{"name":"CVE-2025-15366"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998987Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"affected","timestamp":"2026-08-25T12:02:03.724369Z","vulnerability":{"name":"CVE-2026-6879"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998971Z","products":[{"@id":"pkg:nuget/System.Security.Cryptography.Xml@9.0.17"}],"status":"affected","timestamp":"2026-08-25T12:01:57.062793Z","vulnerability":{"name":"CVE-2026-47304"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.998975Z","products":[{"@id":"pkg:golang/stdlib@1.26.5"}],"status":"affected","timestamp":"2026-08-25T12:01:57.06337Z","vulnerability":{"name":"CVE-2026-56858"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:13:20.99899Z","products":[{"@id":"pkg:generic/python@3.13.14"}],"status":"affected","timestamp":"2026-08-25T12:02:03.725569Z","vulnerability":{"name":"CVE-2026-12003"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.111064Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.111063Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"affected","timestamp":"2026-08-25T11:55:39.111063Z","vulnerability":{"name":"CVE-2026-34040"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.11152Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.11152Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"under_investigation","timestamp":"2026-08-25T11:55:39.11152Z","vulnerability":{"name":"CVE-2026-14456"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.113213Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.113213Z","products":[{"@id":"pkg:deb/ubuntu/libgcrypt20@1.10.3-2ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libgcrypt20@1.10.3-2ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:55:39.113212Z","vulnerability":{"name":"CVE-2024-2236"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.113403Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.113403Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-08-25T11:55:39.113403Z","vulnerability":{"name":"CVE-2026-57433"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.114383Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.114383Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"affected","timestamp":"2026-08-25T11:55:39.114383Z","vulnerability":{"name":"CVE-2026-33997"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.114478Z","impact_statement":"CVE-2026-9538 is a memory-exhaustion denial-of-service in Perl's Archive::Tar module. The Datadog Agent image ships only perl-base, the stripped-down Perl interpreter with no optional modules, and does not install the full perl or perl-modules packages that contain Archive::Tar.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:55:39.114478Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"not_affected","timestamp":"2026-08-25T11:55:39.114478Z","vulnerability":{"name":"CVE-2026-9538"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.115266Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.115266Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-08-25T11:55:39.115266Z","vulnerability":{"name":"CVE-2026-13221"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.115496Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.115496Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-08-25T11:55:39.115495Z","vulnerability":{"name":"CVE-2026-19487"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.115811Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.115811Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-08-25T11:55:39.115811Z","vulnerability":{"name":"CVE-2026-7017"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.115993Z","impact_statement":"The ffmpeg-related packages identified in the scan are transitive dependencies introduced through the browser components used by the Synthetics worker. They are not directly invoked by Datadog application code, but are installed as part of the underlying operating system and Chrome dependencies required for browser-based test execution.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-08-25T11:55:39.115993Z","products":[{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"}],"status":"not_affected","timestamp":"2026-08-25T11:55:39.115992Z","vulnerability":{"name":"CVE-2025-1352"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.116154Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.116153Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-08-25T11:55:39.116153Z","vulnerability":{"name":"CVE-2026-12087"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.116359Z","impact_statement":"CVE-2026-48959 is a CPU exhaustion vulnerability in the Perl module IO::Uncompress::Unzip. The Agent ships only perl-base, the minimal Ubuntu Perl runtime, and does not install the libio-compress-perl package.","justification":"component_not_present","last_updated":"2026-08-25T11:55:39.116358Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"not_affected","timestamp":"2026-08-25T11:55:39.116358Z","vulnerability":{"name":"CVE-2026-48959"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.116858Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.116858Z","products":[{"@id":"pkg:deb/ubuntu/diffutils@1%3A3.10-1build1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/diffutils@3.10-1build1?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/diffutils@1%3A3.10-1build1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/diffutils@3.10-1build1?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"}],"status":"affected","timestamp":"2026-08-25T11:55:39.116858Z","vulnerability":{"name":"CVE-2026-53910"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.117026Z","impact_statement":"The image ships only perl-base, a stripped-down package that provides only the bare Perl runtime needed by system init scripts, without any CPAN modules","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:55:39.117026Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"not_affected","timestamp":"2026-08-25T11:55:39.117026Z","vulnerability":{"name":"CVE-2026-48962"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.117587Z","impact_statement":"While the vulnerable libpam0g package is present in the Datadog Agent's Ubuntu base image, the Agent does not use PAM for authentication operations, making this vulnerability not exploitable in the Agent's context.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T11:55:39.117587Z","products":[{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.6?arch=all\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.6?arch=all\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"}],"status":"not_affected","timestamp":"2026-08-25T11:55:39.117587Z","vulnerability":{"name":"CVE-2024-10041"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.118163Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.118161Z","products":[{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:55:39.118161Z","vulnerability":{"name":"CVE-2016-2781"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.11828Z","impact_statement":"While the vulnerable shadow-utils version is present, the critical exploitation tool (newuidmap) is NOT installed, making the vulnerability unexploitable. Additionally, container architecture eliminates all prerequisite conditions for exploitation.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:55:39.11828Z","products":[{"@id":"pkg:deb/ubuntu/login@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/login@4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/passwd@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/passwd@4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/login@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/login@4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/passwd@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/passwd@4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"}],"status":"not_affected","timestamp":"2026-08-25T11:55:39.11828Z","vulnerability":{"name":"CVE-2024-56433"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.118736Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.118736Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-08-25T11:55:39.118736Z","vulnerability":{"name":"CVE-2016-20013"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.119191Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.119191Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-08-25T11:55:39.119191Z","vulnerability":{"name":"CVE-2026-57432"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.119413Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.119413Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-08-25T11:55:39.119413Z","vulnerability":{"name":"CVE-2026-6791"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.11993Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.11993Z","products":[{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"}],"status":"affected","timestamp":"2026-08-25T11:55:39.11993Z","vulnerability":{"name":"CVE-2025-1376"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.120077Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.120077Z","products":[{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"}],"status":"affected","timestamp":"2026-08-25T11:55:39.120077Z","vulnerability":{"name":"CVE-2022-3219"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.120777Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.120777Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-08-25T11:55:39.120777Z","vulnerability":{"name":"CVE-2026-15534"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.120991Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.120991Z","products":[{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:55:39.120991Z","vulnerability":{"name":"CVE-2026-56392"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.121079Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.121078Z","products":[{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=acl"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=acl"}],"status":"affected","timestamp":"2026-08-25T11:55:39.121078Z","vulnerability":{"name":"CVE-2026-54369"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.121214Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.121214Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:55:39.121214Z","vulnerability":{"name":"CVE-2026-13595"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.123628Z","impact_statement":"No Datadog Agent runtime code path invokes `sort` with any of the CVE conditions: all Go `sort` references are the in-memory standard library package, and the only system `sort` calls exist in build-time-only install scripts using simple `-r`/`-rn` flags on static, hardcoded inputs. Debian classifies this as \"unimportant\" (\"Crash in CLI tool, no security impact\") and Ubuntu as Low priority.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:55:39.123628Z","products":[{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"not_affected","timestamp":"2026-08-25T11:55:39.123628Z","vulnerability":{"name":"CVE-2025-5278"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.123722Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.123722Z","products":[{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=p11-kit"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=p11-kit"}],"status":"affected","timestamp":"2026-08-25T11:55:39.123722Z","vulnerability":{"name":"CVE-2026-13757"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.123899Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.123898Z","products":[{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:55:39.123898Z","vulnerability":{"name":"CVE-2026-56391"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.124011Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.124011Z","products":[{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:55:39.124011Z","vulnerability":{"name":"CVE-2026-18508"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.124106Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.124106Z","products":[{"@id":"pkg:deb/ubuntu/libattr1@1%3A2.5.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=attr"},{"@id":"pkg:deb/ubuntu/libattr1@2.5.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libattr1@1%3A2.5.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=attr"},{"@id":"pkg:deb/ubuntu/libattr1@2.5.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"}],"status":"affected","timestamp":"2026-08-25T11:55:39.124106Z","vulnerability":{"name":"CVE-2026-54371"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.124371Z","impact_statement":"The Datadog Agent image embeds only perl-base and does not install libio-compress-perl or perl-modules.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:55:39.124371Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"not_affected","timestamp":"2026-08-25T11:55:39.124371Z","vulnerability":{"name":"CVE-2025-15649"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.124955Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.124954Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:55:39.124954Z","vulnerability":{"name":"CVE-2026-27456"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.127414Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.127414Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-08-25T11:55:39.127414Z","vulnerability":{"name":"CVE-2026-6368"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.127842Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.127842Z","products":[{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=p11-kit"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=p11-kit"}],"status":"affected","timestamp":"2026-08-25T11:55:39.127842Z","vulnerability":{"name":"CVE-2026-18938"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.127965Z","impact_statement":"The Datadog Agent ships only libsystemd0, a shared utility library for client-side systemd APIs such as sd_notify. The journald daemon binary is entirely absent from the image.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:55:39.127965Z","products":[{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"}],"status":"not_affected","timestamp":"2026-08-25T11:55:39.127965Z","vulnerability":{"name":"CVE-2026-40228"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.12816Z","impact_statement":"tic is a terminfo compiler, a build/development tool that the Datadog Agent never invokes. It has no reverse dependencies in the image and the agent's runtime dependency graph never calls it. The vulnerable code path in postprocess_termcap is only reachable by running tic with a crafted input file, which the agent process never does.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-08-25T11:55:39.12816Z","products":[{"@id":"pkg:deb/ubuntu/libncursesw6@6.4%2B20240113-1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libncursesw6@6.4%2B20240113-1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/libtinfo6@6.4%2B20240113-1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libtinfo6@6.4%2B20240113-1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/ncurses-base@6.4%2B20240113-1ubuntu2.1?arch=all\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/ncurses-base@6.4%2B20240113-1ubuntu2.1?arch=all\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/ncurses-bin@6.4%2B20240113-1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/ncurses-bin@6.4%2B20240113-1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/libncursesw6@6.4%2B20240113-1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libncursesw6@6.4%2B20240113-1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/libtinfo6@6.4%2B20240113-1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libtinfo6@6.4%2B20240113-1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/ncurses-bin@6.4%2B20240113-1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/ncurses-bin@6.4%2B20240113-1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"}],"status":"not_affected","timestamp":"2026-08-25T11:55:39.12816Z","vulnerability":{"name":"CVE-2025-6141"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.128574Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.128574Z","products":[{"@id":"pkg:golang/github.com/cilium/ebpf@v0.21.0"}],"status":"under_investigation","timestamp":"2026-08-25T11:55:39.128574Z","vulnerability":{"name":"CVE-2026-10722"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.128663Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.128663Z","products":[{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=acl"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=acl"}],"status":"affected","timestamp":"2026-08-25T11:55:39.128663Z","vulnerability":{"name":"CVE-2026-54370"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.128862Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.128862Z","products":[{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"}],"status":"affected","timestamp":"2026-08-25T11:55:39.128862Z","vulnerability":{"name":"CVE-2026-57062"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.129029Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.129029Z","products":[{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:55:39.129029Z","vulnerability":{"name":"CVE-2026-18477"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.129105Z","impact_statement":"The Datadog Agent performs bzip2 decompression exclusively through Go's built-in compress/bzip2 standard library package, a pure Go implementation that makes no calls to libbz2 or any system bzip2 binary.","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:55:39.129105Z","products":[{"@id":"pkg:deb/ubuntu/libbz2-1.0@1.0.8-5.1build0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libbz2-1.0@1.0.8-5.1build0.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=bzip2"},{"@id":"pkg:deb/ubuntu/libbz2-1.0@1.0.8-5.1build0.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libbz2-1.0@1.0.8-5.1build0.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=bzip2"}],"status":"not_affected","timestamp":"2026-08-25T11:55:39.129105Z","vulnerability":{"name":"CVE-2026-42250"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.129682Z","impact_statement":"While libbpf1 version 1.3.0-2build2 is installed and IS vulnerable, the Datadog Agent does not use libbpf. Additionally, the vulnerability is disputed by maintainers as it requires root privileges to trigger.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T11:55:39.129681Z","products":[{"@id":"pkg:deb/ubuntu/libbpf1@1.3.0-2build2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libbpf1@1%3A1.3.0-2build2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=libbpf%401.3.0-2build2"},{"@id":"pkg:deb/ubuntu/libbpf1@1.3.0-2build2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libbpf1@1%3A1.3.0-2build2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=libbpf%401.3.0-2build2"}],"status":"not_affected","timestamp":"2026-08-25T11:55:39.129681Z","vulnerability":{"name":"CVE-2025-29481"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.130058Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.130057Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:55:39.130057Z","vulnerability":{"name":"CVE-2026-53612"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.130205Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.130204Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:55:39.130204Z","vulnerability":{"name":"CVE-2026-53613"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.130358Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.130358Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:55:39.130357Z","vulnerability":{"name":"CVE-2026-53614"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.130506Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.130506Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:55:39.130506Z","vulnerability":{"name":"CVE-2026-53615"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.139537Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.139537Z","products":[{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-08-25T11:55:39.139536Z","vulnerability":{"name":"CVE-2026-75803"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.140141Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.140141Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"affected","timestamp":"2026-08-25T11:55:39.140141Z","vulnerability":{"name":"GO-2026-5617"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.140206Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.140206Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"affected","timestamp":"2026-08-25T11:55:39.140206Z","vulnerability":{"name":"GO-2026-5668"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:55:39.14026Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:55:39.14026Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"affected","timestamp":"2026-08-25T11:55:39.140259Z","vulnerability":{"name":"GO-2026-5746"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:10:39.015679Z","products":[{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"}],"status":"affected","timestamp":"2026-08-25T11:55:39.124605Z","vulnerability":{"name":"CVE-2026-15059"}},{"action_statement":"This vulnerability was fixed in: 7.82.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T12:10:39.01569Z","products":[{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"}],"status":"affected","timestamp":"2026-08-25T11:55:39.12939Z","vulnerability":{"name":"CVE-2026-16742"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:51:45.669742Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:51:45.669742Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:51:45.669742Z","vulnerability":{"name":"CVE-2026-48095"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:51:45.670741Z","impact_statement":"The Datadog Agent has no MimeKit dependency and sends no SMTP mail","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:51:45.670741Z","products":[{"@id":"pkg:nuget/MimeKit@4.3.0.0"}],"status":"not_affected","timestamp":"2026-08-25T11:51:45.670741Z","vulnerability":{"name":"CVE-2026-30227"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:51:45.671191Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:51:45.671191Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"under_investigation","timestamp":"2026-08-25T11:51:45.671191Z","vulnerability":{"name":"CVE-2026-14266"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:51:45.678406Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:51:45.678406Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:51:45.678406Z","vulnerability":{"name":"CVE-2026-48092"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:51:45.679405Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:51:45.679405Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:51:45.679405Z","vulnerability":{"name":"CVE-2026-48101"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:51:45.679479Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:51:45.679479Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:51:45.679479Z","vulnerability":{"name":"CVE-2026-48112"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:51:45.679543Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:51:45.679543Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:51:45.679543Z","vulnerability":{"name":"CVE-2026-48103"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:51:45.679597Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:51:45.679597Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:51:45.679597Z","vulnerability":{"name":"CVE-2026-48111"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:51:46.948397Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:51:46.948397Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:51:46.948397Z","vulnerability":{"name":"CVE-2026-48104"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:51:46.948474Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:51:46.948474Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-08-25T11:51:46.948474Z","vulnerability":{"name":"CVE-2026-48102"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:51:46.948636Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:51:46.948636Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"under_investigation","timestamp":"2026-08-25T11:51:46.948636Z","vulnerability":{"name":"CVE-2026-58052"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:51:46.949632Z","impact_statement":"The agent does not perform S/MIME message processing or X.509 certificate imports via email libraries","justification":"vulnerable_code_not_present","last_updated":"2026-08-25T11:51:46.949632Z","products":[{"@id":"pkg:nuget/MimeKit@4.3.0.0"}],"status":"not_affected","timestamp":"2026-08-25T11:51:46.949632Z","vulnerability":{"name":"GHSA-gmc6-fwg3-75m5"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:54:43.395599Z","impact_statement":"CVE-2018-10126 represents ZERO security risk to the Datadog Agent running on Ubuntu 24.04. Both Ubuntu and Debian security teams have assessed this as having no security impact, and the vulnerability cannot be reproduced in modern versions of the software.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-08-25T11:54:43.395599Z","products":[{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=libjpeg-turbo"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=libjpeg-turbo"}],"status":"not_affected","timestamp":"2026-08-25T11:54:43.395599Z","vulnerability":{"name":"CVE-2018-10126"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:54:43.397556Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:54:43.397556Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-08-25T11:54:43.397556Z","vulnerability":{"name":"CVE-2026-70906"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:54:43.398917Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:54:43.398916Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-08-25T11:54:43.398916Z","vulnerability":{"name":"CVE-2026-61308"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:54:43.597759Z","products":[{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.11?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.11?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"fixed","timestamp":"2026-08-25T11:54:43.597759Z","vulnerability":{"name":"USN-8625-1"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:54:43.399733Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:54:43.399733Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-08-25T11:54:43.399733Z","vulnerability":{"name":"CVE-2026-70907"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:54:43.400138Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:54:43.400138Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-08-25T11:54:43.400138Z","vulnerability":{"name":"CVE-2026-60589"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:59:46.170087Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:59:46.170087Z","products":[{"@id":"pkg:golang/github.com/aws/aws-sdk-go@v1.55.8"}],"status":"affected","timestamp":"2026-08-25T11:59:46.170087Z","vulnerability":{"name":"GO-2022-0635"}},{"action_statement":"","action_statement_timestamp":"2026-08-25T11:59:46.170122Z","impact_statement":"","justification":"","last_updated":"2026-08-25T11:59:46.170122Z","products":[{"@id":"pkg:golang/github.com/aws/aws-sdk-go@v1.55.8"}],"status":"affected","timestamp":"2026-08-25T11:59:46.170122Z","vulnerability":{"name":"GO-2022-0646"}}],"timestamp":"2026-08-06T12:14:11.428533996Z","tooling":"","version":14}