{"@context":"https://openvex.dev/ns/v0.2.0","@id":"pkg:docker/agent@7.83.0","author":"security@datadoghq.com","author_role":"Vulnerability Management","last_updated":"2026-10-13T13:14:16.420823665Z","statements":[{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.906581Z","impact_statement":"The product is not affected by CVE-2019-16294 as the vulnerable component SciLexer.dll is not present","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:52:21.906581Z","products":[{"@id":"pkg:generic/scintilla@4.4.6"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.906581Z","vulnerability":{"name":"CVE-2019-16294"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.906692Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.906692Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T11:52:21.906692Z","vulnerability":{"name":"CVE-2025-30761"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.906735Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK base image. no CMP symbols are even linked into the flagged DLLs in the agent. The Agent's own OpenSSL libraries include the fix.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:52:21.906735Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.3"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.906735Z","vulnerability":{"name":"CVE-2026-63076"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.906937Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK Nano Server base image. The flagged libcrypto DLL does not contain the vulnerable code. The only MinGit binary that loads libssl (libcurl-openssl-4.dll) never calls any RPK API. The Datadog Agent never runs git or MinGit. The Agent's own OpenSSL libraries are fixed.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:52:21.906937Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.3"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.906937Z","vulnerability":{"name":"CVE-2026-18798"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.907081Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK base image. no CMP symbols are even linked into the flagged DLLs in the agent. The Agent's own OpenSSL libraries include the fix.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:52:21.907081Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.3"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.907081Z","vulnerability":{"name":"CVE-2026-63073"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.907307Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.907307Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.907307Z","vulnerability":{"name":"CVE-2025-9086"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.907359Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.907359Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.907359Z","vulnerability":{"name":"CVE-2025-5399"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.907395Z","impact_statement":"The agent uses Java for JMXFetch which runs only trusted, administrator-installed code to gather metrics from JMX-enabled applications making the exploitation scenario described in this CVE inapplicable to the agent's use case.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T11:52:21.907395Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.907395Z","vulnerability":{"name":"CVE-2025-30749"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.907433Z","impact_statement":"CVE-2026-6473 is a PostgreSQL **server-side** integer wraparound vulnerability. The Datadog Agent does not ship or run a PostgreSQL server.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:21.907433Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.907433Z","vulnerability":{"name":"CVE-2026-6473"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.907462Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK Nano Server base image. The flagged libcrypto DLL does not contain the vulnerable code. The only MinGit binary that loads libssl (libcurl-openssl-4.dll) never calls any RPK API. The Datadog Agent never runs git or MinGit. The Agent's own OpenSSL libraries are fixed.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:52:21.907462Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.3"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.907462Z","vulnerability":{"name":"CVE-2026-14457"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.907633Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.907633Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.907633Z","vulnerability":{"name":"CVE-2026-3805"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.907664Z","impact_statement":"Oracle's advisory explicitly exempts server-side Java deployments running trusted code and the Datadog Agent JMX fetcher is a server-side process running only the trusted jmxfetch.jar","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T11:52:21.907664Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.907664Z","vulnerability":{"name":"CVE-2026-21945"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.907689Z","impact_statement":"The Datadog Agent has no MimeKit dependency and sends no SMTP mail","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:21.907689Z","products":[{"@id":"pkg:nuget/MimeKit@4.3.0.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.907689Z","vulnerability":{"name":"CVE-2026-30227"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.907716Z","impact_statement":"the vulnerable curl.exe is part of the Microsoft Windows base OS layer. The Datadog Agent never runs it: no Agent code, entrypoint or install script calls curl.exe, and the Agent's HTTP clients are Go net/http, not libcurl. The vulnerability needs curl to open a WebSocket connection to a malicious server, which the product never does. The finding will clear when Microsoft ships a patched ltsc2025 base image.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:52:21.907716Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.907716Z","vulnerability":{"name":"CVE-2026-19931"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.90784Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK base image. The flagged libssl DLL contains no CMS code. No MinGit binary that loads either libcrypto copy (libcurl, the OpenSSL engines and providers, OpenSSH, Heimdal, FIDO2) references any CMS function. The Datadog Agent never runs git or MinGit, and the Agent's own OpenSSL libraries include the fix.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:52:21.90784Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.3"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.90784Z","vulnerability":{"name":"CVE-2026-63072"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.907978Z","impact_statement":"CVE-2026-80229 affects only libcurl builds that use the OpenSSL 3+ TLS backend. The libcurl DLL bundled in the confluent-kafka Windows wheel is built with Schannel. It links only Secur32, CRYPT32 and bcrypt and contains no OpenSSL code, provider or library-context APIs, so the vulnerable lib/vtls/openssl.c code is not present. Its only caller, librdkafka, also uses just the libcurl easy interface and never the multi interface that the flaw requires.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:21.907978Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.907978Z","vulnerability":{"name":"CVE-2026-80231"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.908092Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.908092Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T11:52:21.908092Z","vulnerability":{"name":"CVE-2026-34282"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.908203Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.908203Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.908203Z","vulnerability":{"name":"CVE-2026-11856"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.908265Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.908265Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.908265Z","vulnerability":{"name":"CVE-2025-21587"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.908299Z","impact_statement":"CVE-2026-8924 is a bypass of curl's Public Suffix List (libpsl) cookie-scope check, using trailing-dot host names and cookie domains. The curl project scopes it to PSL-enabled builds, and notes that builds without PSL never perform this protection in the first place. The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 and 8.16.0) is Microsoft's inbox curl tool from the Windows Nano Server base OS layer, built without libpsl: there are 0 'libpsl' or 'psl_' strings, no 'libpsl/%s' component in curl_version() (only 'zlib/%s'), and no PSL library import. The 'PSL' token in the binary is curl's static feature-name table. The PSL check code containing the flaw is therefore not present. The Datadog Agent also never runs curl.exe.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:21.908299Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.908299Z","vulnerability":{"name":"CVE-2026-8924"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.90834Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK base image. the Datadog Agent's own code contains no QUIC implementation of any kind. The only MinGit consumer of libssl (libcurl-openssl-4.dll) references only TLS_client_method and TLS_method, and the Agent never runs git or MinGit. The Agent's own OpenSSL libraries include the fix","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:52:21.90834Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.3"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.90834Z","vulnerability":{"name":"CVE-2026-63075"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.908525Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.908525Z","products":[{"@id":"pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.11"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.908525Z","vulnerability":{"name":"CVE-2026-73500"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.908596Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.908596Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.908596Z","vulnerability":{"name":"CVE-2026-10536"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.908658Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.908658Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.908658Z","vulnerability":{"name":"CVE-2026-16239"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.908718Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.908718Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.908718Z","vulnerability":{"name":"CVE-2026-14266"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.90875Z","impact_statement":"CVE-2026-9079 is a libcurl flaw where clearing proxy authentication credentials on a reused handle does not take effect, so later transfers reuse stale proxy credentials. The curl project states: 'This flaw does not affect the curl command line tool.' The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 on 1809/ltsc2022, 8.16.0 on ltsc2025) is Microsoft's inbox curl command-line tool from the Windows Nano Server base OS layer, built with Schannel. The Datadog Agent never runs curl.exe. No application in the image uses it as a library, so the affected libcurl handle-reuse path is never exercised.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:52:21.90875Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.90875Z","vulnerability":{"name":"CVE-2026-9079"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.90878Z","impact_statement":"OpenSSL is used exclusively as a CLI tool (e.g., certificate operations) and is never run as a QUIC server. The Agent does not implement QUIC/HTTP3 in any form, so the vulnerable code path is not present, making it not exploitable.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:21.90878Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.3"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.90878Z","vulnerability":{"name":"CVE-2026-14456"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.908969Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.908969Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T11:52:21.908969Z","vulnerability":{"name":"CVE-2025-50106"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.90903Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.90903Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.90903Z","vulnerability":{"name":"CVE-2026-14669"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.909062Z","impact_statement":"the vulnerable curl.exe is part of the Microsoft Windows base OS layer. The Datadog Agent never runs it: no Agent code, entrypoint or install script calls curl.exe, and the Agent's HTTP clients are Go net/http, not libcurl. The vulnerability needs curl to open a WebSocket connection to a malicious server, which the product never does. The finding will clear when Microsoft ships a patched ltsc2025 base image.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:52:21.909062Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.909062Z","vulnerability":{"name":"CVE-2026-18924"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.909193Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.909193Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T11:52:21.909193Z","vulnerability":{"name":"CVE-2026-22016"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.909251Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.909251Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T11:52:21.909251Z","vulnerability":{"name":"CVE-2025-53066"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.909307Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.909307Z","products":[{"@id":"pkg:golang/golang.org/x/net@v0.57.0"},{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.909307Z","vulnerability":{"name":"CVE-2026-78663"}},{"action_statement":"This vulnerability was fixed in: 7.84.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"The vulnerability is only reachable through servers constructed via  xds.NewGRPCServer(). The datadog-agent does not import google.golang.org/grpc/xds anywhere in its codebase and constructs all internal gRPC servers using the standard grpc.NewServer() API. The vulnerable code is not present, making this vulnerability not exploitable. The dependency will be patched in newer versions of the image.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:10.329274Z","products":[{"@id":"pkg:golang/google.golang.org/grpc@v1.83.0"}],"status":"affected","timestamp":"2026-10-13T11:52:21.909644Z","vulnerability":{"name":"CVE-2026-84445"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-10-13T11:52:21.909825Z","vulnerability":{"name":"CVE-2026-48095"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.909882Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.909882Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.909882Z","vulnerability":{"name":"CVE-2025-21502"}},{"action_statement":"This vulnerability was fixed in: 7.84.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:10.329274Z","products":[{"@id":"pkg:golang/google.golang.org/grpc@v1.83.0"}],"status":"affected","timestamp":"2026-10-13T11:52:21.909934Z","vulnerability":{"name":"CVE-2026-84304"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.910118Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.910118Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.910118Z","vulnerability":{"name":"CVE-2026-5773"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:nuget/Microsoft.AspNetCore.Server.IISIntegration@9.0.19"}],"status":"affected","timestamp":"2026-10-13T11:52:21.910224Z","vulnerability":{"name":"CVE-2026-69304"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.910264Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK Nano Server base image. CVE-2026-54874 affects only DTLS endpoints that buffer future-epoch records during a handshake. No binary in the image uses DTLS. The only MinGit consumer of libssl (libcurl-openssl-4.dll) references only TLS_client_method and TLS_method, and the Agent never runs git or MinGit. The Agent's own OpenSSL libraries include the fix.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:52:21.910264Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.3"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.910264Z","vulnerability":{"name":"CVE-2026-54874"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.910438Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.910438Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.910438Z","vulnerability":{"name":"CVE-2026-56857"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.910631Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.910631Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T11:52:21.910631Z","vulnerability":{"name":"CVE-2025-50059"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.910667Z","impact_statement":"CVE-2026-8927 is a libcurl flaw in which reusing one easy handle for sequential transfers through different environment-configured proxies leaks a Digest Proxy-Authorization header to the second proxy. The curl project states that it does not affect the curl command-line tool. The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 and 8.16.0) is that command-line tool, Microsoft's inbox build from the Windows Nano Server base OS layer. It is not a libcurl library exposed to applications. No application in the image loads it as a library, and the Datadog Agent never runs curl.exe, so the affected handle-reuse path is never exercised.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:21.910667Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.910667Z","vulnerability":{"name":"CVE-2026-8927"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.910757Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.910757Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.910757Z","vulnerability":{"name":"CVE-2026-15742"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.910794Z","impact_statement":"CVE-2026-6479 is an uncontrolled recursion vulnerability in the PostgreSQL server-side SSL/GSS connection negotiation path. The Datadog Agent bundle the PostgreSQL client wire-protocol library","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:21.910794Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.910794Z","vulnerability":{"name":"CVE-2026-6479"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.910849Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.910849Z","products":[{"@id":"pkg:golang/golang.org/x/net@v0.57.0"},{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.910849Z","vulnerability":{"name":"CVE-2026-78659"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.91122Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.91122Z","products":[{"@id":"pkg:golang/golang.org/x/net@v0.57.0"},{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.91122Z","vulnerability":{"name":"CVE-2026-78669"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.91155Z","impact_statement":"CVE-2026-80229 affects only libcurl builds that use the OpenSSL 3+ TLS backend. The libcurl DLL bundled in the confluent-kafka Windows wheel is built with Schannel. It links only Secur32, CRYPT32 and bcrypt and contains no OpenSSL code, provider or library-context APIs, so the vulnerable lib/vtls/openssl.c code is not present. Its only caller, librdkafka, also uses just the libcurl easy interface and never the multi interface that the flaw requires.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:21.91155Z","products":[{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.91155Z","vulnerability":{"name":"CVE-2026-80229"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.911627Z","impact_statement":"CVE-2026-6478 is a covert timing-channel vulnerability in the PostgreSQL server's MD5 password-comparison routine during client authentication. The Datadog agent image does not ship or run a PostgreSQL server","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:21.911627Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.911627Z","vulnerability":{"name":"CVE-2026-6478"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.911695Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.911695Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.911695Z","vulnerability":{"name":"CVE-2026-6253"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.91176Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.91176Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.91176Z","vulnerability":{"name":"CVE-2026-17084"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.911931Z","impact_statement":"C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 and 8.16.0) is Microsoft's inbox curl tool in the Nano Server base OS layer. It includes the affected .netrc credential lookup (curl 8.11.1 to 8.20.0). The flaw is triggered only when a user runs curl with netrc enabled against a URL that has a username but no password, while .netrc holds another user's credentials for the same host. The Datadog Agent never runs curl.exe, has no code path that passes netrc options to it, and ships no .netrc file, so the vulnerable code is never run by the product.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:21.911931Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.911931Z","vulnerability":{"name":"CVE-2026-8926"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/openssl@3.6.3"}],"status":"affected","timestamp":"2026-10-13T11:52:21.911983Z","vulnerability":{"name":"CVE-2026-54876"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.9121Z","impact_statement":"False positive. The vulnerability only affects Python TLS servers whose sni_callback reassigns SSLSocket.context. The Datadog Agent and its integrations use Python's ssl module only as a TLS client (not as a server); no server-side SSLContext or sni_callback is used. So the vulnerable code is present in the embedded runtime but is never executed, and a remote client cannot trigger it.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:21.9121Z","products":[{"@id":"pkg:generic/python@3.13.15"},{"@id":"pkg:docker/agent@\u003cversion\u003e"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.9121Z","vulnerability":{"name":"CVE-2026-19445"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.912303Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.912303Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.912303Z","vulnerability":{"name":"CVE-2025-14819"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.912361Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.912361Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.912361Z","vulnerability":{"name":"CVE-2026-6471"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.912397Z","impact_statement":"Oracle advisory explicitly excludes server deployments; AWT/JavaFX not used; UI:R unsatisfiable","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T11:52:21.912397Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.912397Z","vulnerability":{"name":"CVE-2026-21932"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.912447Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.912447Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.912447Z","vulnerability":{"name":"CVE-2026-15741"}},{"action_statement":"This vulnerability was fixed in: 7.84.1","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:30:12.591424Z","products":[{"@id":"pkg:golang/golang.org/x/crypto@v0.54.0"}],"status":"affected","timestamp":"2026-10-13T11:52:21.912502Z","vulnerability":{"name":"CVE-2026-56855"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.912612Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.912612Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.912612Z","vulnerability":{"name":"CVE-2026-14662"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.912653Z","impact_statement":"CVE-2026-9080 is a libcurl use-after-free triggered only when an application calls curl_easy_pause() from inside the multi interface's event-based CURLMOPT_SOCKETFUNCTION callback. The curl project states: 'This flaw does not affect the curl command line tool.' The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 on 1809/ltsc2022, 8.16.0 on ltsc2025) is Microsoft's inbox curl command-line tool from the Windows Nano Server base OS layer, built with Schannel. The Datadog Agent never runs curl.exe. The tool does not install such a callback, and no application in the image uses it as a library, so the vulnerable path is never exercised.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:52:21.912653Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.912653Z","vulnerability":{"name":"CVE-2026-9080"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.91269Z","impact_statement":"A server superuser would need to force the agent to call the non-existent lo_read() code path. However no code path in the agent ever calls PQfn() or any lo_* function.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:52:21.91269Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.91269Z","vulnerability":{"name":"CVE-2026-6477"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.912722Z","impact_statement":"the vulnerable curl.exe is part of the Microsoft Windows base OS layer. The Datadog Agent never runs it: no Agent code, entrypoint or install script calls curl.exe, and the Agent's HTTP clients are Go net/http, not libcurl. The vulnerability needs curl to open a WebSocket connection to a malicious server, which the product never does. The finding will clear when Microsoft ships a patched ltsc2025 base image.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:52:21.912722Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.912722Z","vulnerability":{"name":"CVE-2026-13608"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.912841Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.912841Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.912841Z","vulnerability":{"name":"CVE-2026-14664"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.912895Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.912895Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.912895Z","vulnerability":{"name":"CVE-2026-14670"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.912954Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.912954Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.912954Z","vulnerability":{"name":"CVE-2026-14676"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.913011Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.913011Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.913011Z","vulnerability":{"name":"CVE-2026-47057"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.913097Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.913097Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.913097Z","vulnerability":{"name":"CVE-2025-14524"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.913183Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.913183Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.913183Z","vulnerability":{"name":"CVE-2026-19385"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.913235Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.913235Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.6.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.913235Z","vulnerability":{"name":"CVE-2026-54873"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.913487Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.913487Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.913487Z","vulnerability":{"name":"CVE-2026-14677"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.913545Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.913545Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.913545Z","vulnerability":{"name":"CVE-2026-14680"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.913605Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.913605Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.913605Z","vulnerability":{"name":"CVE-2026-14671"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/git@2.55.0.windows.3"}],"status":"affected","timestamp":"2026-10-13T11:52:21.91368Z","vulnerability":{"name":"CVE-2026-62960"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-10-13T11:52:21.914031Z","vulnerability":{"name":"CVE-2026-48092"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.914091Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.914091Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.914091Z","vulnerability":{"name":"CVE-2026-16238"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:golang/golang.org/x/crypto@v0.54.0"}],"status":"affected","timestamp":"2026-10-13T11:52:21.914186Z","vulnerability":{"name":"CVE-2026-56854"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.914304Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.914304Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.914304Z","vulnerability":{"name":"CVE-2025-30698"}},{"action_statement":"This vulnerability was fixed in: 7.84.1","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:30:12.591424Z","products":[{"@id":"pkg:golang/golang.org/x/crypto@v0.54.0"}],"status":"affected","timestamp":"2026-10-13T11:52:21.91436Z","vulnerability":{"name":"CVE-2026-78662"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.914452Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK base image. no CMP symbols are even linked into the flagged DLLs in the agent. The Agent's own OpenSSL libraries include the fix.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:52:21.914452Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.3"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.914452Z","vulnerability":{"name":"CVE-2026-63074"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.914623Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.914623Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.6.3"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:52:21.914623Z","vulnerability":{"name":"CVE-2026-84782"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.914848Z","impact_statement":"CVE-2026-9545 (HTTP/3 early data exposed to an impostor server) is specific to curl built with the ngtcp2 + nghttp3 HTTP/3 backend, with TLS early data enabled. The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 on 1809/ltsc2022, 8.16.0 on ltsc2025) is Microsoft's inbox curl command-line tool from the Windows Nano Server base OS layer, built with Schannel. The Datadog Agent never runs curl.exe. It contains no HTTP/3 backend: there are 0 occurrences of ngtcp2, nghttp3, quiche, msh3 or OpenSSL-QUIC and no corresponding version components (the '--http3' and 'HTTP/3' strings are generic tool help and option text). The vulnerable HTTP/3 code is therefore not present.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:21.914848Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.914848Z","vulnerability":{"name":"CVE-2026-9545"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.91488Z","impact_statement":"CVE-2026-82208 exists only in libcurl builds that use the wolfSSL TLS backend, and the curl project states that it does not affect the curl command-line tool. The flagged C:\\\\Windows\\\\System32\\\\curl.exe is Microsoft's inbox curl tool built with the Schannel backend. It contains no wolfSSL code and links only Windows crypto (CRYPT32 and bcrypt). It ships in the Microsoft Nano Server base OS layer, and the Datadog Agent never runs it","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:21.91488Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:21.91488Z","vulnerability":{"name":"CVE-2026-82208"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.914998Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.914998Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.914998Z","vulnerability":{"name":"CVE-2026-7168"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.915056Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.915056Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.915056Z","vulnerability":{"name":"CVE-2026-94440"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:21.915271Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:21.915271Z","products":[{"@id":"pkg:generic/python@3.13.15"},{"@id":"pkg:docker/agent@\u003cversion\u003e"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:21.915271Z","vulnerability":{"name":"CVE-2026-19553"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.648723Z","impact_statement":"","justification":"component_not_present","last_updated":"2026-10-13T11:52:22.648723Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.6.3"}],"status":"not_affected","timestamp":"2026-10-13T11:52:22.648723Z","vulnerability":{"name":"CVE-2026-84784"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.649037Z","impact_statement":"CVE-2026-6637 is a stack buffer overflow and SQL injection vulnerability in the PostgreSQL server-side `refint` contrib module, requiring an active PostgreSQL server with `refint` triggers installed to exploit which the Datadog agent does not embed.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:22.649037Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T11:52:22.649037Z","vulnerability":{"name":"CVE-2026-6637"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.649186Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.649186Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.649186Z","vulnerability":{"name":"CVE-2026-12064"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.649268Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.649268Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.649268Z","vulnerability":{"name":"CVE-2026-8932"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.649342Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.649342Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.649342Z","vulnerability":{"name":"CVE-2026-97031"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.649548Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.649548Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.649548Z","vulnerability":{"name":"CVE-2026-5545"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.649621Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.649621Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T11:52:22.649621Z","vulnerability":{"name":"CVE-2026-41254"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.649662Z","impact_statement":"CVE-2026-82209 applies only to curl builds with libpsl support enabled. The flagged C:\\\\Windows\\\\System32\\\\curl.exe is Microsoft's inbox curl tool and is built without libpsl: it has no libpsl symbols or strings, no libpsl/%s version component and no PSL library import, so the vulnerable PSL cookie-domain code path is absent. The binary ships in the Microsoft Nano Server base OS layer, and the Datadog Agent never runs it or uses its cookie engine.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:22.649662Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:22.649662Z","vulnerability":{"name":"CVE-2026-82209"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.649784Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.649784Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T11:52:22.649784Z","vulnerability":{"name":"CVE-2025-53057"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.649882Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.649882Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.649882Z","vulnerability":{"name":"CVE-2026-15806"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.650099Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.650099Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.650099Z","vulnerability":{"name":"CVE-2026-18408"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.650176Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.650176Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.650176Z","vulnerability":{"name":"CVE-2026-47058"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.650236Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.650236Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.650236Z","vulnerability":{"name":"CVE-2026-78667"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.650472Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.650472Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.650472Z","vulnerability":{"name":"CVE-2025-15079"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.650537Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.650537Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.650537Z","vulnerability":{"name":"CVE-2026-6464"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.650577Z","impact_statement":"CVE-2026-80229 affects only libcurl builds that use the OpenSSL 3+ TLS backend. The libcurl DLL bundled in the confluent-kafka Windows wheel is built with Schannel. It links only Secur32, CRYPT32 and bcrypt and contains no OpenSSL code, provider or library-context APIs, so the vulnerable lib/vtls/openssl.c code is not present. Its only caller, librdkafka, also uses just the libcurl easy interface and never the multi interface that the flaw requires.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:22.650577Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:22.650577Z","vulnerability":{"name":"CVE-2026-80230"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.650703Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.650703Z","products":[{"@id":"pkg:generic/zlib@1.3.2"},{"@id":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=zlib"},{"@id":"pkg:deb/ubuntu/zlib1g@1.3.dfsg-3.1ubuntu2.2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=zlib"},{"@id":"pkg:deb/ubuntu/zlib1g@1.3.dfsg-3.1ubuntu2.2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"}],"status":"affected","timestamp":"2026-10-13T11:52:22.650703Z","vulnerability":{"name":"CVE-2026-85091"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.650773Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.650773Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.650773Z","vulnerability":{"name":"CVE-2026-3783"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.650839Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.650839Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.650839Z","vulnerability":{"name":"CVE-2026-3784"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.650909Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.650909Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.650909Z","vulnerability":{"name":"CVE-2026-87910"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.651103Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.651103Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.651103Z","vulnerability":{"name":"CVE-2026-19672"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.651299Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.651299Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.651299Z","vulnerability":{"name":"CVE-2026-47063"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.651361Z","impact_statement":"The Datadog Agent does not ship or run a PostgreSQL server","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:22.651361Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T11:52:22.651361Z","vulnerability":{"name":"CVE-2026-6475"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.65142Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.65142Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.65142Z","vulnerability":{"name":"CVE-2026-6429"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.651478Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.651478Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.651478Z","vulnerability":{"name":"CVE-2026-6276"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.651535Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.651535Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.651535Z","vulnerability":{"name":"CVE-2026-14668"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:35:26.486843Z","products":[{"@id":"pkg:pypi/pip@26.1.1"}],"status":"affected","timestamp":"2026-10-13T11:52:22.651589Z","vulnerability":{"name":"CVE-2026-8643"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.651683Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.651683Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.651683Z","vulnerability":{"name":"CVE-2025-10148"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:golang/golang.org/x/text@v0.40.0"}],"status":"affected","timestamp":"2026-10-13T11:52:22.651774Z","vulnerability":{"name":"CVE-2026-56851"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.651997Z","impact_statement":"CVE-2026-9547 (SSH host key type mismatch accepted) affects only libcurl built with the libssh backend, for SCP/SFTP transfers using CURLOPT_SSH_KEYFUNCTION. The curl project states that libssh2 builds are not affected and that the flaw does not affect the curl command line tool. The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 on 1809/ltsc2022, 8.16.0 on ltsc2025) is Microsoft's inbox curl command-line tool from the Windows Nano Server base OS layer, built with Schannel. The Datadog Agent never runs curl.exe. It contains no libssh backend: there are 0 'libssh' strings, 0 ssh_* API references and no 'libssh/%s' component (the single 'libssh2' token is curl's static feature-name table). The vulnerable code is therefore not present, and the binary is the unaffected command-line tool.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:22.651997Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:22.651997Z","vulnerability":{"name":"CVE-2026-9547"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.652059Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.652059Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.652059Z","vulnerability":{"name":"CVE-2026-8286"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.652122Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.652122Z","products":[{"@id":"pkg:pypi/urllib3@2.7.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.652122Z","vulnerability":{"name":"CVE-2026-97689"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.652207Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.652207Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.652207Z","vulnerability":{"name":"CVE-2026-94439"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:22.652418Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:22.652418Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:22.652418Z","vulnerability":{"name":"CVE-2026-56866"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.818452Z","impact_statement":"","justification":"component_not_present","last_updated":"2026-10-13T11:52:23.818452Z","products":[{"@id":"pkg:generic/sqlite@3.51.1"},{"@id":"pkg:generic/sqlite@3.43.2"}],"status":"not_affected","timestamp":"2026-10-13T11:52:23.818452Z","vulnerability":{"name":"CVE-2026-11822"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.818741Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.818741Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.818741Z","vulnerability":{"name":"CVE-2026-14679"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-10-13T11:52:23.818822Z","vulnerability":{"name":"CVE-2026-48101"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.818888Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.818888Z","products":[{"@id":"pkg:golang/golang.org/x/net@v0.57.0"},{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.818888Z","vulnerability":{"name":"CVE-2026-78660"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-10-13T11:52:23.819313Z","vulnerability":{"name":"CVE-2026-48112"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:golang/golang.org/x/mod@v0.38.0"}],"status":"affected","timestamp":"2026-10-13T11:52:23.819376Z","vulnerability":{"name":"CVE-2026-56864"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-10-13T11:52:23.819547Z","vulnerability":{"name":"CVE-2026-48103"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-10-13T11:52:23.819613Z","vulnerability":{"name":"CVE-2026-48111"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.819656Z","impact_statement":"The Datadog Agent does not load or run untrusted Java code and is not a sandboxed Java runtime for customer applications. Accordingly, under normal and supported usage, Datadog has identified no viable exploit path for these vulnerabilities","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T11:52:23.819656Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-10-13T11:52:23.819656Z","vulnerability":{"name":"CVE-2025-30754"}},{"action_statement":"This vulnerability was fixed in: 7.84.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:10.329274Z","products":[{"@id":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0"}],"status":"affected","timestamp":"2026-10-13T11:52:23.819708Z","vulnerability":{"name":"CVE-2026-81872"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.819758Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.819758Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.819758Z","vulnerability":{"name":"CVE-2026-101917"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.819839Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.819839Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.819839Z","vulnerability":{"name":"CVE-2026-8458"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.819882Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.819882Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.819882Z","vulnerability":{"name":"CVE-2026-102274"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.819931Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.819931Z","products":[{"@id":"pkg:golang/github.com/containerd/containerd/v2@v2.2.5"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.819931Z","vulnerability":{"name":"CVE-2026-53493"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.819999Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.819999Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.819999Z","vulnerability":{"name":"CVE-2026-47021"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.820072Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.820072Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.820072Z","vulnerability":{"name":"CVE-2026-6476"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.820109Z","impact_statement":"MinGit bundled in datadog agent \u003e= 7.83.3 (windows/amd64), inherited unmodified from the upstream microsoft base image, ships OpenSSL 3.5.7, which is genuinely inside the vulnerable range for CVE-2026-75803 (fixed in 3.5.8) and not yet remediated upstream by Microsoft. However, the flaw only manifests for callers that invoke the low-level, deprecated one-shot EVP_Cipher() API directly for AES-OCB/ChaCha20-Poly1305 AEAD decryption of an empty ciphertext and trust its return code alone as tag validation. MinGit's only consumers, git.exe and curl.exe, perform TLS exclusively through OpenSSL's standard high-level record-layer/EVP_DecryptUpdate+Final path and never call EVP_Cipher() for AEAD operations, and neither implements any custom AEAD message-forgery-checking logic of its own. The vulnerable code path is therefore never reached in this deployment, regardless of the outstanding version gap.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:23.820109Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.3"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"not_affected","timestamp":"2026-10-13T11:52:23.820109Z","vulnerability":{"name":"CVE-2026-75803"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.8203Z","impact_statement":"The vulnerability is a command injection via newlines in the `poplib` module (Python's POP3 email client library). No agent code uses `poplib`, the agent is an infrastructure monitoring tool with no email/POP3 functionality","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:23.8203Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"not_affected","timestamp":"2026-10-13T11:52:23.8203Z","vulnerability":{"name":"CVE-2025-15367"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.820485Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.820485Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.820485Z","vulnerability":{"name":"CVE-2026-46917"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.820537Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.820537Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.820537Z","vulnerability":{"name":"CVE-2026-47027"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.820585Z","impact_statement":"This vulnerability detection is a false positive caused by overly broad CPE matching in vulnerability databases. The CVE does not apply to the Windows Datadog Agent.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:23.820585Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T11:52:23.820585Z","vulnerability":{"name":"CVE-2017-8806"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.820634Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.820634Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.6.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.820634Z","vulnerability":{"name":"CVE-2026-72897"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.820886Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.820886Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.6.3"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:52:23.820886Z","vulnerability":{"name":"CVE-2026-75806"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.821118Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.821118Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.821118Z","vulnerability":{"name":"CVE-2025-10966"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.821217Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.821217Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.821217Z","vulnerability":{"name":"CVE-2026-4873"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.821277Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.821277Z","products":[{"@id":"pkg:pypi/pymongo@4.8.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.821277Z","vulnerability":{"name":"CVE-2026-96748"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.821323Z","impact_statement":"The Datadog Agent does not ship or run a PostgreSQL server","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:23.821323Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T11:52:23.821323Z","vulnerability":{"name":"CVE-2026-6638"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.821364Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.821364Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.821364Z","vulnerability":{"name":"CVE-2026-101918"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.821416Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.821416Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.821416Z","vulnerability":{"name":"CVE-2026-61308"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.821452Z","impact_statement":"This is a false positive. The datadog/agent only uses PyJWT to sign outgoing RS256 assertions with a private key (DC/OS authentication, and Azure/MSAL and OAuth client credentials). It never verifies an incoming JWT with HMAC (HS*) allowed, so the bypassable check in HMACAlgorithm.prepare_key never runs (vulnerable code not present). The fix for this vulnerability will be present in v7.84.3 of the agent.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:23.821452Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:23.821452Z","vulnerability":{"name":"CVE-2026-102268"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.821506Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.821506Z","products":[{"@id":"pkg:pypi/urllib3@2.7.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.821506Z","vulnerability":{"name":"CVE-2026-97687"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.821563Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.821563Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.6.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.821563Z","vulnerability":{"name":"CVE-2026-75804"}},{"action_statement":"This vulnerability was fixed in: 7.84.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:10.329274Z","products":[{"@id":"pkg:golang/google.golang.org/grpc@v1.83.0"}],"status":"affected","timestamp":"2026-10-13T11:52:23.821815Z","vulnerability":{"name":"CVE-2026-84303"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.821976Z","impact_statement":"This vulnerability cannot be exploited in the Datadog Agent container. MinGit is an unused component from the PowerShell base image with proper ACL protections. The container security model eliminates the attack surface required for exploitation.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T11:52:23.821976Z","products":[{"@id":"pkg:generic/msys2@3.6.9-b4195d69133078c498a1bf811c4fb0c61fc3c8af"}],"status":"not_affected","timestamp":"2026-10-13T11:52:23.821976Z","vulnerability":{"name":"CVE-2022-37172"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.822029Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.822029Z","products":[{"@id":"pkg:pypi/urllib3@2.7.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.822029Z","vulnerability":{"name":"CVE-2026-97688"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.822079Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.822079Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.6.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.822079Z","vulnerability":{"name":"CVE-2026-42772"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.822327Z","impact_statement":"The UI:R (user interaction required) prerequisite is structurally unsatisfiable in a containerized agent service, and the attack path described targets sandboxed client deployments","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T11:52:23.822327Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-10-13T11:52:23.822327Z","vulnerability":{"name":"CVE-2026-21933"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.822383Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.822383Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.822383Z","vulnerability":{"name":"CVE-2026-60147"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.82244Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.82244Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.82244Z","vulnerability":{"name":"CVE-2025-4947"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.822491Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.822491Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.822491Z","vulnerability":{"name":"CVE-2026-46968"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.822547Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.822547Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T11:52:23.822547Z","vulnerability":{"name":"CVE-2026-22021"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.822589Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.822589Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.822589Z","vulnerability":{"name":"CVE-2026-102265"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:35:26.486843Z","products":[{"@id":"pkg:pypi/pip@26.1.1"}],"status":"affected","timestamp":"2026-10-13T11:52:23.822644Z","vulnerability":{"name":"CVE-2026-13346"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.822704Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.822704Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.822704Z","vulnerability":{"name":"CVE-2026-6470"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.822766Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.822766Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.822766Z","vulnerability":{"name":"CVE-2026-1965"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.822821Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.822821Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.822821Z","vulnerability":{"name":"CVE-2026-82049"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.823007Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.823007Z","products":[{"@id":"pkg:pypi/pymongo@4.8.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.823007Z","vulnerability":{"name":"CVE-2026-88029"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.82309Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.82309Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.82309Z","vulnerability":{"name":"CVE-2025-15224"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.823187Z","impact_statement":"The Datadog Agent contains no PostgreSQL server binaries. The agent bundles only the psycopg Python client library and its libpq dependency on Linux builds; the Windows build contains neither","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:23.823187Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T11:52:23.823187Z","vulnerability":{"name":"CVE-2026-6474"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.823242Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.823242Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.823242Z","vulnerability":{"name":"CVE-2025-5025"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.823306Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.823306Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.823306Z","vulnerability":{"name":"CVE-2026-70907"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.823354Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.823354Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:23.823354Z","vulnerability":{"name":"CVE-2026-6575"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.8234Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:23.8234Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"affected","timestamp":"2026-10-13T11:52:23.8234Z","vulnerability":{"name":"CVE-2026-103001"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:23.82344Z","impact_statement":"The vulnerability affects the `mimetypes` module's use of Unix-style paths on Windows. No agent code uses `mimetypes` and no local users exist in the container","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T11:52:23.82344Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"not_affected","timestamp":"2026-10-13T11:52:23.82344Z","vulnerability":{"name":"CVE-2024-3220"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.737088Z","impact_statement":"","justification":"component_not_present","last_updated":"2026-10-13T11:52:24.737088Z","products":[{"@id":"pkg:generic/sqlite@3.51.1"},{"@id":"pkg:generic/sqlite@3.43.2"}],"status":"not_affected","timestamp":"2026-10-13T11:52:24.737088Z","vulnerability":{"name":"CVE-2026-11824"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.737433Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.737433Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.6.3"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:52:24.737433Z","vulnerability":{"name":"CVE-2026-35189"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.737714Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.737714Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.737714Z","vulnerability":{"name":"CVE-2026-102266"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.737757Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.737757Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.737757Z","vulnerability":{"name":"CVE-2026-102272"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.737832Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.737832Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.737832Z","vulnerability":{"name":"CVE-2026-15310"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.738009Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.738009Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.738009Z","vulnerability":{"name":"CVE-2026-102271"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.738069Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.738069Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T11:52:24.738069Z","vulnerability":{"name":"CVE-2026-22013"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.738119Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.738119Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.738119Z","vulnerability":{"name":"CVE-2026-102273"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.738234Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.738234Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.738234Z","vulnerability":{"name":"CVE-2025-13034"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.738307Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.738307Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.738307Z","vulnerability":{"name":"CVE-2026-14672"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.738369Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.738369Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.738369Z","vulnerability":{"name":"CVE-2026-21925"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.738416Z","impact_statement":"This vulnerability lives entirely in PostgreSQL's DDL privilege-checking code and has no client-library component. The Datadog Agent bundles only `libpq` a client wire-protocol library that contains no DDL authorization logic.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:24.738416Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T11:52:24.738416Z","vulnerability":{"name":"CVE-2026-6472"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.738465Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.738465Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.6.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.738465Z","vulnerability":{"name":"CVE-2026-35191"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.738729Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.738729Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.738729Z","vulnerability":{"name":"CVE-2026-102267"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-10-13T11:52:24.738791Z","vulnerability":{"name":"CVE-2026-48102"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.738849Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.738849Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.6.3"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:52:24.738849Z","vulnerability":{"name":"CVE-2026-75805"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"affected","timestamp":"2026-10-13T11:52:24.739106Z","vulnerability":{"name":"CVE-2026-48104"}},{"action_statement":"This vulnerability was fixed in: 7.84.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:10.329274Z","products":[{"@id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.20.0"}],"status":"affected","timestamp":"2026-10-13T11:52:24.739201Z","vulnerability":{"name":"CVE-2026-81871"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.739264Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.739264Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.739264Z","vulnerability":{"name":"CVE-2026-6469"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.739325Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.739325Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.739325Z","vulnerability":{"name":"CVE-2026-47059"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:golang/golang.org/x/mod@v0.38.0"}],"status":"affected","timestamp":"2026-10-13T11:52:24.739378Z","vulnerability":{"name":"CVE-2026-56865"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.73954Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.73954Z","products":[{"@id":"pkg:pypi/pymongo@4.8.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.73954Z","vulnerability":{"name":"CVE-2026-96749"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.739586Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.739586Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.739586Z","vulnerability":{"name":"CVE-2026-102270"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.739633Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.739633Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.6.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.739633Z","vulnerability":{"name":"CVE-2026-54875"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.739918Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.739918Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.739918Z","vulnerability":{"name":"CVE-2026-12345"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.740125Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.740125Z","products":[{"@id":"pkg:golang/github.com/containerd/containerd/v2@v2.2.5"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.740125Z","vulnerability":{"name":"CVE-2026-53495"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.740249Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.740249Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.740249Z","vulnerability":{"name":"CVE-2026-102269"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.740315Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.740315Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.740315Z","vulnerability":{"name":"CVE-2026-14678"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.740389Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.740389Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.740389Z","vulnerability":{"name":"CVE-2026-18024"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.740448Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.740448Z","products":[{"@id":"pkg:golang/golang.org/x/net@v0.57.0"},{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.740448Z","vulnerability":{"name":"CVE-2026-97032"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.7408Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.7408Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.7408Z","vulnerability":{"name":"CVE-2026-94448"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.741021Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.741021Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.741021Z","vulnerability":{"name":"CVE-2026-97030"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.741226Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.741226Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T11:52:24.741226Z","vulnerability":{"name":"CVE-2026-22018"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.741286Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.741286Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.741286Z","vulnerability":{"name":"CVE-2026-60589"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.741362Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.741362Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.6.3"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:52:24.741362Z","vulnerability":{"name":"CVE-2026-54872"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.741652Z","impact_statement":"The Datadog Agent's Go binary uses Go's standard library `compress/zlib` (pure Go, no linkage to system libz), and Python's `zlib` module, while linking against system libz, does not expose `crc32_combine64` to Python userspace.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T11:52:24.741652Z","products":[{"@id":"pkg:generic/zlib@1.3.1"},{"@id":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=zlib"},{"@id":"pkg:deb/ubuntu/zlib1g@1.3.dfsg-3.1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=zlib"},{"@id":"pkg:deb/ubuntu/zlib1g@1.3.dfsg-3.1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"}],"status":"not_affected","timestamp":"2026-10-13T11:52:24.741652Z","vulnerability":{"name":"CVE-2026-27171"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.741708Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.741708Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.31%2B11-1ubuntu1~24.04.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.741708Z","vulnerability":{"name":"CVE-2026-47010"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.741764Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.741764Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.741764Z","vulnerability":{"name":"CVE-2026-102275"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.741825Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.741825Z","products":[{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.6.3"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:52:24.741825Z","vulnerability":{"name":"CVE-2026-77696"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.742102Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.742102Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.742102Z","vulnerability":{"name":"CVE-2026-14666"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.742194Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.742194Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.742194Z","vulnerability":{"name":"CVE-2026-58052"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.742255Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.742255Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T11:52:24.742255Z","vulnerability":{"name":"CVE-2026-23865"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.74233Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.74233Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.74233Z","vulnerability":{"name":"CVE-2026-16241"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.742393Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.742393Z","products":[{"@id":"pkg:pypi/pymongo@4.8.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.742393Z","vulnerability":{"name":"CVE-2026-96747"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.742486Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.742486Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.742486Z","vulnerability":{"name":"CVE-2025-14017"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.742546Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.742546Z","products":[{"@id":"pkg:golang/github.com/moby/sys/user@v0.4.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.742546Z","vulnerability":{"name":"CVE-2026-61801"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.742634Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.742634Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.742634Z","vulnerability":{"name":"CVE-2026-14673"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.742715Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.742715Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.742715Z","vulnerability":{"name":"CVE-2026-14663"}},{"action_statement":"This vulnerability was fixed in: 7.84.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:10.329274Z","products":[{"@id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.44.0"},{"@id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.44.0"},{"@id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.44.0"},{"@id":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0"}],"status":"affected","timestamp":"2026-10-13T11:52:24.742771Z","vulnerability":{"name":"CVE-2026-81870"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.742921Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.742921Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T11:52:24.742921Z","vulnerability":{"name":"CVE-2026-34268"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.742977Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.742977Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T11:52:24.742977Z","vulnerability":{"name":"CVE-2026-22007"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.743036Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.743036Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.743036Z","vulnerability":{"name":"CVE-2026-14681"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.743076Z","impact_statement":"The agent does not perform S/MIME message processing or X.509 certificate imports via email libraries","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:24.743076Z","products":[{"@id":"pkg:nuget/MimeKit@4.3.0.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:24.743076Z","vulnerability":{"name":"GHSA-gmc6-fwg3-75m5"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.743128Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.743128Z","products":[{"@id":"pkg:pypi/oauthlib@3.3.1"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.743128Z","vulnerability":{"name":"CVE-2026-49264"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.743204Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.743204Z","products":[{"@id":"pkg:pypi/oauthlib@3.3.1"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.743204Z","vulnerability":{"name":"CVE-2026-49265"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.74325Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.74325Z","products":[{"@id":"pkg:cargo/rustls@0.23.41"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.74325Z","vulnerability":{"name":"GHSA-2mjx-qc3c-rqvc"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.743293Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.743293Z","products":[{"@id":"pkg:pypi/tuf@4.0.0"}],"status":"affected","timestamp":"2026-10-13T11:52:24.743293Z","vulnerability":{"name":"GHSA-qp9x-wp8f-qgjj"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.743318Z","impact_statement":"The advisory affects only golang.org/x/crypto/openpgp, which is deprecated    and will not be fixed. The Datadog Agent depends on the golang.org/x/crypto module only for    golang.org/x/crypto/nacl/box (via pkg/fleet/daemon). The openpgp package is never imported,    directly or indirectly, so it is not compiled into any Agent binary: a full package-graph check    (go list -deps ./... for linux, windows and darwin) finds no golang.org/x/crypto/openpgp package.    The Agent's PGP/GPG code (comp/metadata/packagesigning/impl/readgpg.go and    pkg/util/kernel/headers/download/rpm/dnfv2/repo/repo.go) already uses the recommended replacement,   github.com/ProtonMail/go-crypto/openpgp. No action is needed.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:52:24.743318Z","products":[{"@id":"pkg:golang/golang.org/x/crypto@v0.54.0"}],"status":"not_affected","timestamp":"2026-10-13T11:52:24.743318Z","vulnerability":{"name":"GO-2026-5932"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.743393Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.743393Z","products":[{"@id":"pkg:nuget/NuGet.Packaging@6.14.3-rc.1"},{"@id":"pkg:nuget/NuGet.Protocol@6.14.3-rc.1"}],"status":"under_investigation","timestamp":"2026-10-13T11:52:24.743393Z","vulnerability":{"name":"GHSA-g4vj-cjjj-v7hg"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:35:26.486843Z","products":[{"@id":"pkg:cargo/faster-hex@0.10.0"}],"status":"affected","timestamp":"2026-10-13T11:52:24.743445Z","vulnerability":{"name":"RUSTSEC-2026-0306"}},{"action_statement":"This vulnerability was fixed in: 7.84.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:10.329274Z","products":[{"@id":"pkg:golang/github.com/google/cel-go@v0.29.2"}],"status":"affected","timestamp":"2026-10-13T11:52:24.743474Z","vulnerability":{"name":"GO-2026-6094"}},{"action_statement":"This vulnerability was fixed in: 7.84.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:10.329274Z","products":[{"@id":"pkg:cargo/h2@0.4.14"}],"status":"affected","timestamp":"2026-10-13T11:52:24.743506Z","vulnerability":{"name":"RUSTSEC-2026-0258"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:52:24.743535Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.743535Z","products":[{"@id":"pkg:cargo/unsafe-libyaml@0.2.11"}],"status":"affected","timestamp":"2026-10-13T11:52:24.743535Z","vulnerability":{"name":"RUSTSEC-2024-0449"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.853873Z","products":[{"@id":"pkg:pypi/ddtrace@3.19.5"}],"status":"fixed","timestamp":"2026-10-13T11:52:24.853873Z","vulnerability":{"name":"CVE-2026-50271"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.853873Z","products":[{"@id":"pkg:pypi/pyasn1@0.6.3"}],"status":"fixed","timestamp":"2026-10-13T11:52:24.853873Z","vulnerability":{"name":"CVE-2026-59885"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.853873Z","products":[{"@id":"pkg:pypi/pyasn1@0.6.3"}],"status":"fixed","timestamp":"2026-10-13T11:52:24.853873Z","vulnerability":{"name":"CVE-2026-59884"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.853873Z","products":[{"@id":"pkg:pypi/pyasn1@0.6.3"}],"status":"fixed","timestamp":"2026-10-13T11:52:24.853873Z","vulnerability":{"name":"CVE-2026-59886"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.853873Z","products":[{"@id":"pkg:pypi/cryptography@48.0.1"}],"status":"fixed","timestamp":"2026-10-13T11:52:24.853873Z","vulnerability":{"name":"CVE-2026-69247"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.853873Z","products":[{"@id":"pkg:pypi/cryptography@48.0.1"}],"status":"fixed","timestamp":"2026-10-13T11:52:24.853873Z","vulnerability":{"name":"CVE-2026-69249"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.853873Z","products":[{"@id":"pkg:pypi/cryptography@48.0.1"}],"status":"fixed","timestamp":"2026-10-13T11:52:24.853873Z","vulnerability":{"name":"CVE-2026-69248"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.853873Z","products":[{"@id":"pkg:pypi/paramiko@4.0.0"}],"status":"fixed","timestamp":"2026-10-13T11:52:24.853873Z","vulnerability":{"name":"CVE-2026-44405"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.853873Z","products":[{"@id":"pkg:cargo/hickory-resolver@0.26.1"}],"status":"fixed","timestamp":"2026-10-13T11:52:24.853873Z","vulnerability":{"name":"GHSA-5j98-2g5x-46v6"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.853873Z","products":[{"@id":"pkg:cargo/hickory-resolver@0.26.1"}],"status":"fixed","timestamp":"2026-10-13T11:52:24.853873Z","vulnerability":{"name":"GHSA-6w6g-hm98-mhgm"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.853873Z","products":[{"@id":"pkg:golang/github.com/google/cel-go@v0.28.1"}],"status":"fixed","timestamp":"2026-10-13T11:52:24.853873Z","vulnerability":{"name":"GHSA-gcjh-h69q-9w9g"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.853873Z","products":[{"@id":"pkg:cargo/hickory-resolver@0.26.1"}],"status":"fixed","timestamp":"2026-10-13T11:52:24.853873Z","vulnerability":{"name":"GHSA-6f2x-v7q7-m7m5"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:52:24.853873Z","products":[{"@id":"pkg:golang/github.com/klauspost/compress@v1.18.6"}],"status":"fixed","timestamp":"2026-10-13T11:52:24.853873Z","vulnerability":{"name":"GO-2026-5841"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:12.833926Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:12.833926Z","products":[{"@id":"pkg:generic/krb5@1.21.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:12.833926Z","vulnerability":{"name":"CVE-2007-5894"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:12.834126Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:12.834126Z","products":[{"@id":"pkg:generic/krb5@1.21.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:12.834126Z","vulnerability":{"name":"CVE-2026-40355"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:12.834193Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:12.834193Z","products":[{"@id":"pkg:generic/krb5@1.21.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:12.834193Z","vulnerability":{"name":"CVE-2026-40356"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:12.836048Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:12.836048Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-10-13T11:48:12.836048Z","vulnerability":{"name":"CVE-2026-82560"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.636141Z","impact_statement":"The vulnerability is in the Docker Engine daemon's plugin privilege validation (plugin/manager.go). The image contains no Docker daemon. The Agent binary links only github.com/docker/docker/pkg/system, an indirect Trivy dependency, and none of the plugin or daemon packages. The embedded module is also pinned to moby 28.x commit 31a1689cb0a1, which includes the backported fix 0afb41ce194c, and the module is declared at the patched version v29.3.1.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:48:13.636141Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"not_affected","timestamp":"2026-10-13T11:48:13.636141Z","vulnerability":{"name":"CVE-2026-33997"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.636886Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.636886Z","products":[{"@id":"pkg:generic/krb5@1.21.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:13.636886Z","vulnerability":{"name":"CVE-2007-3149"}},{"action_statement":"This vulnerability was fixed in: 7.83.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:11:39.088529Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-10-13T11:48:13.638306Z","vulnerability":{"name":"CVE-2026-19487"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.638485Z","impact_statement":"The ffmpeg-related packages identified in the scan are transitive dependencies introduced through the browser components used by the Synthetics worker. They are not directly invoked by Datadog application code, but are installed as part of the underlying operating system and Chrome dependencies required for browser-based test execution.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:48:13.638485Z","products":[{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"}],"status":"not_affected","timestamp":"2026-10-13T11:48:13.638485Z","vulnerability":{"name":"CVE-2025-1352"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.638594Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.638594Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T11:48:13.638594Z","vulnerability":{"name":"CVE-2026-86145"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:03:29.709441Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:13.638939Z","vulnerability":{"name":"CVE-2026-77117"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:03:29.709441Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:13.639048Z","vulnerability":{"name":"CVE-2026-80489"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.639609Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.639609Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:13.639609Z","vulnerability":{"name":"CVE-2026-8674"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:03:29.709441Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:13.640016Z","vulnerability":{"name":"CVE-2026-19499"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.64027Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.64027Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T11:48:13.64027Z","vulnerability":{"name":"CVE-2026-89156"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.640354Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.640354Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:13.640354Z","vulnerability":{"name":"CVE-2026-97399"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.640544Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.640544Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T11:48:13.640544Z","vulnerability":{"name":"CVE-2026-89157"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.640855Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.640855Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T11:48:13.640855Z","vulnerability":{"name":"CVE-2026-89160"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.640944Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.640944Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:13.640944Z","vulnerability":{"name":"CVE-2026-89092"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.641129Z","impact_statement":"While the vulnerable libpam0g package is present in the Datadog Agent's Ubuntu base image, the Agent does not use PAM for authentication operations, making this vulnerability not exploitable in the Agent's context.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T11:48:13.641129Z","products":[{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.7?arch=all\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.7?arch=all\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"}],"status":"not_affected","timestamp":"2026-10-13T11:48:13.641129Z","vulnerability":{"name":"CVE-2024-10041"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.6415Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.6415Z","products":[{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.3?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:13.6415Z","vulnerability":{"name":"CVE-2016-2781"}},{"action_statement":"This vulnerability was fixed in: 7.83.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:11:39.088529Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-10-13T11:48:13.641571Z","vulnerability":{"name":"CVE-2026-15534"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.641699Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.641699Z","products":[{"@id":"pkg:deb/ubuntu/login@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/login@4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/passwd@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/passwd@4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/login@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/login@4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/passwd@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/passwd@4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"}],"status":"affected","timestamp":"2026-10-13T11:48:13.641699Z","vulnerability":{"name":"CVE-2024-56433"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.642002Z","impact_statement":"The vulnerability is in the Docker Engine daemon's AuthZ plugin request forwarding (pkg/authorization/authz.go). The image contains no Docker daemon, and no binary links github.com/docker/docker/pkg/authorization. The Agent links only pkg/system, an indirect Trivy dependency. The embedded module is also pinned to moby 28.x commit 31a1689cb0a1, which includes both backported fixes (6d311e0d8d41 and db7dadaca041). The Agent uses the Docker API only as a client and never runs AuthZ middleware.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:48:13.642002Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"not_affected","timestamp":"2026-10-13T11:48:13.642002Z","vulnerability":{"name":"CVE-2026-34040"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.642055Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.642055Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T11:48:13.642055Z","vulnerability":{"name":"CVE-2026-89158"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:03:29.709441Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:13.642363Z","vulnerability":{"name":"CVE-2026-19542"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:03:29.709441Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:13.642611Z","vulnerability":{"name":"CVE-2026-6791"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.642816Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.642816Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:13.642816Z","vulnerability":{"name":"CVE-2016-20013"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.64302Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.64302Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:13.64302Z","vulnerability":{"name":"CVE-2026-76642"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.644108Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.644108Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T11:48:13.644108Z","vulnerability":{"name":"CVE-2026-103111"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.644626Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.644626Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:13.644626Z","vulnerability":{"name":"CVE-2026-78408"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.645847Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.645847Z","products":[{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"}],"status":"affected","timestamp":"2026-10-13T11:48:13.645847Z","vulnerability":{"name":"CVE-2025-1376"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.646605Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.646605Z","products":[{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"}],"status":"affected","timestamp":"2026-10-13T11:48:13.646605Z","vulnerability":{"name":"CVE-2022-3219"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.646935Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.646935Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T11:48:13.646935Z","vulnerability":{"name":"CVE-2026-89162"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.64701Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.64701Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:13.64701Z","vulnerability":{"name":"CVE-2026-78410"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.648153Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.648153Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:13.648153Z","vulnerability":{"name":"CVE-2026-78409"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.649247Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.649247Z","products":[{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=acl"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=acl"}],"status":"affected","timestamp":"2026-10-13T11:48:13.649247Z","vulnerability":{"name":"CVE-2026-54369"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.649394Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.649394Z","products":[{"@id":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:13.649394Z","vulnerability":{"name":"CVE-2026-102474"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.649451Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.649451Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:13.649451Z","vulnerability":{"name":"CVE-2026-18374"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.649644Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.649644Z","products":[{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:13.649644Z","vulnerability":{"name":"CVE-2026-18508"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.649803Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.649803Z","products":[{"@id":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:13.649803Z","vulnerability":{"name":"CVE-2026-102473"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.649862Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.649862Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:13.649862Z","vulnerability":{"name":"CVE-2026-95818"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.650049Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.650049Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T11:48:13.650049Z","vulnerability":{"name":"CVE-2026-89161"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.650127Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.650127Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:13.650127Z","vulnerability":{"name":"CVE-2026-86805"}},{"action_statement":"This vulnerability was fixed in: 7.83.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:03:29.709441Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:13.650441Z","vulnerability":{"name":"CVE-2026-6368"}},{"action_statement":"This vulnerability was fixed in: 7.83.1","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:55:08.687691Z","products":[{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"}],"status":"affected","timestamp":"2026-10-13T11:48:13.650783Z","vulnerability":{"name":"CVE-2026-57062"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.650861Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.650861Z","products":[{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=acl"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=acl"}],"status":"affected","timestamp":"2026-10-13T11:48:13.650861Z","vulnerability":{"name":"CVE-2026-54370"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.650922Z","impact_statement":"The Datadog Agent ships only libsystemd0, a shared utility library for client-side systemd APIs such as sd_notify. The journald daemon binary is entirely absent from the image.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:48:13.650922Z","products":[{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.17?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.17?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.17?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.17?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.17?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.17?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.17?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.17?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"}],"status":"not_affected","timestamp":"2026-10-13T11:48:13.650922Z","vulnerability":{"name":"CVE-2026-40228"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.651051Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.651051Z","products":[{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:13.651051Z","vulnerability":{"name":"CVE-2026-18477"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.651096Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.651096Z","products":[{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"}],"status":"affected","timestamp":"2026-10-13T11:48:13.651096Z","vulnerability":{"name":"CVE-2026-105712"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.65117Z","impact_statement":"While libbpf1 version 1.3.0-2build2 is installed and IS vulnerable, the Datadog Agent does not use libbpf. Additionally, the vulnerability is disputed by maintainers as it requires root privileges to trigger.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T11:48:13.65117Z","products":[{"@id":"pkg:deb/ubuntu/libbpf1@1.3.0-2build2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libbpf1@1%3A1.3.0-2build2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=libbpf%401.3.0-2build2"},{"@id":"pkg:deb/ubuntu/libbpf1@1.3.0-2build2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libbpf1@1%3A1.3.0-2build2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=libbpf%401.3.0-2build2"}],"status":"not_affected","timestamp":"2026-10-13T11:48:13.65117Z","vulnerability":{"name":"CVE-2025-29481"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.651479Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.651479Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"affected","timestamp":"2026-10-13T11:48:13.651479Z","vulnerability":{"name":"GO-2026-5617"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.651511Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.651511Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"affected","timestamp":"2026-10-13T11:48:13.651511Z","vulnerability":{"name":"GO-2026-5668"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:13.651542Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.651542Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"affected","timestamp":"2026-10-13T11:48:13.651542Z","vulnerability":{"name":"GO-2026-5746"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/libgcrypt20@1.10.3-2ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libgcrypt20@1.10.3-2ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2024-2236"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-48959"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-48962"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-9538"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-13221"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-12087"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-57433"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/diffutils@1%3A3.10-1build1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/diffutils@3.10-1build1?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/diffutils@1%3A3.10-1build1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/diffutils@3.10-1build1?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-53910"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-7017"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-57432"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=p11-kit"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=p11-kit"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-13757"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2025-5278"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-13595"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=p11-kit"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=p11-kit"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-18938"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/libattr1@1%3A2.5.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=attr"},{"@id":"pkg:deb/ubuntu/libattr1@2.5.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libattr1@1%3A2.5.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=attr"},{"@id":"pkg:deb/ubuntu/libattr1@2.5.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-54371"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2025-15649"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-27456"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/libncursesw6@6.4%2B20240113-1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libncursesw6@6.4%2B20240113-1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/libtinfo6@6.4%2B20240113-1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libtinfo6@6.4%2B20240113-1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/ncurses-base@6.4%2B20240113-1ubuntu2.1?arch=all\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/ncurses-base@6.4%2B20240113-1ubuntu2.1?arch=all\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/ncurses-bin@6.4%2B20240113-1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/ncurses-bin@6.4%2B20240113-1ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/libncursesw6@6.4%2B20240113-1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libncursesw6@6.4%2B20240113-1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/libtinfo6@6.4%2B20240113-1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libtinfo6@6.4%2B20240113-1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"},{"@id":"pkg:deb/ubuntu/ncurses-bin@6.4%2B20240113-1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/ncurses-bin@6.4%2B20240113-1ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=ncurses"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2025-6141"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/libbz2-1.0@1.0.8-5.1build0.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libbz2-1.0@1.0.8-5.1build0.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=bzip2"},{"@id":"pkg:deb/ubuntu/libbz2-1.0@1.0.8-5.1build0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libbz2-1.0@1.0.8-5.1build0.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=bzip2"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-42250"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:golang/github.com/cilium/ebpf@v0.21.0"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-10722"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-53612"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-53613"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-53614"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:13.765784Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.5"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"fixed","timestamp":"2026-10-13T11:48:13.765784Z","vulnerability":{"name":"CVE-2026-53615"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:36.780915Z","impact_statement":"CVE-2025-6965 is a memory corruption vulnerability in SQLite \u003c 3.50.2. The Datadog Windows agent image is not vulnerable: the embedded CPython build is explicitly pinned to SQLite 3.53.0, and the Go SQLite modules (mattn/go-sqlite3, modernc.org/sqlite, glebarez/go-sqlite) are gated behind LINUX_ONLY_TAGS and are never compiled into Windows builds. The only winsqlite3.dll present belongs to the Windows Server 2019 OS base layer which is never loaded by the agent process","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:48:36.780915Z","products":[{"@id":"pkg:generic/sqlite@3.43.2"}],"status":"not_affected","timestamp":"2026-10-13T11:48:36.780915Z","vulnerability":{"name":"CVE-2025-6965"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:36.781784Z","impact_statement":"CVE-2026-8925 is a double free in curl's libgsasl-based SASL code (IMAP, POP3 and SMTP) and affects curl 8.15.0 to 8.20.0 only when curl is built with libgsasl. The flagged C:\\\\Windows\\\\System32\\\\curl.exe is Microsoft's inbox curl tool. On 1809 and ltsc2022 it is 8.13.0, which predates the bug. On ltsc2025 it is 8.16.0 but built without libgsasl: there is no libgsasl version component or import, so the vulnerable code is absent. The binary ships in the Microsoft base OS layer, and the Datadog Agent never runs it.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:48:36.781784Z","products":[{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T11:48:36.781784Z","vulnerability":{"name":"CVE-2026-8925"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:36.785586Z","impact_statement":"the vulnerable curl.exe is part of the Microsoft Windows base OS layer. The Datadog Agent never runs it: no Agent code, entrypoint or install script calls curl.exe, and the Agent's HTTP clients are Go net/http, not libcurl. The vulnerability needs curl to open a WebSocket connection to a malicious server, which the product never does. The finding will clear when Microsoft ships a patched ltsc2025 base image.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:48:36.785586Z","products":[{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T11:48:36.785586Z","vulnerability":{"name":"CVE-2026-11586"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:36.788141Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:36.788141Z","products":[{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:36.788141Z","vulnerability":{"name":"CVE-2026-80255"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:37.527169Z","impact_statement":"The Datadog Agent Windows image (\u003e7.82.0) ships three separate SQLite consumers: the embedded Python 3 `sqlite3.dll`, and the Go-based `mattn/go-sqlite3` and `modernc.org/sqlite` libraries used by the Agent binary and none of them are affected: (1) every embedded SQLite version is already ≥3.53.0, well past the fixed version 3.51.1, and (2) the `zipfile` extension is an optional, non-default SQLite component that is not compiled into any of these builds (zero occurrences of `zipfileInflate`/`zipfileModule`/`SQLITE_ENABLE_ZIPFILE` in any binary or source we inspected). This mirrors Debian's own tracker classification of \"unimportant,\" which notes the zipfile extension isn't built into their SQLite packages either.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:48:37.527169Z","products":[{"@id":"pkg:generic/sqlite@3.43.2"}],"status":"not_affected","timestamp":"2026-10-13T11:48:37.527169Z","vulnerability":{"name":"CVE-2025-70873"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:47:38.249879Z","impact_statement":"CVE-2018-10126 represents ZERO security risk to the Datadog Agent running on Ubuntu 24.04. Both Ubuntu and Debian security teams have assessed this as having no security impact, and the vulnerability cannot be reproduced in modern versions of the software.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T11:47:38.249879Z","products":[{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=libjpeg-turbo"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=libjpeg-turbo"}],"status":"not_affected","timestamp":"2026-10-13T11:47:38.249879Z","vulnerability":{"name":"CVE-2018-10126"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:47:39.169178Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:47:39.169178Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T11:47:39.169178Z","vulnerability":{"name":"CVE-2026-83357"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:47:39.169772Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:47:39.169772Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T11:47:39.169772Z","vulnerability":{"name":"CVE-2026-83408"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:47:39.171156Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:47:39.171156Z","products":[{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=libjpeg-turbo"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=libjpeg-turbo"}],"status":"affected","timestamp":"2026-10-13T11:47:39.171156Z","vulnerability":{"name":"CVE-2026-75466"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:47:39.172648Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:47:39.172648Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T11:47:39.172648Z","vulnerability":{"name":"CVE-2026-94114"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:47:39.17296Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:47:39.17296Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T11:47:39.17296Z","vulnerability":{"name":"CVE-2026-83368"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:47:39.174539Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:47:39.174539Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T11:47:39.174539Z","vulnerability":{"name":"CVE-2026-105111"}},{"action_statement":"This vulnerability was fixed in: 7.83.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:45.960952Z","products":[{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=sqlite3"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=sqlite3"}],"status":"affected","timestamp":"2026-10-13T11:47:39.177634Z","vulnerability":{"name":"CVE-2026-39113"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:47:39.185792Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:47:39.185792Z","products":[{"@id":"pkg:golang/github.com/aws/aws-sdk-go@v1.55.8"}],"status":"affected","timestamp":"2026-10-13T11:47:39.185792Z","vulnerability":{"name":"GO-2022-0635"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:47:39.18583Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:47:39.18583Z","products":[{"@id":"pkg:golang/github.com/aws/aws-sdk-go@v1.55.8"}],"status":"affected","timestamp":"2026-10-13T11:47:39.18583Z","vulnerability":{"name":"GO-2022-0646"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:47:39.282606Z","products":[{"@id":"pkg:golang/github.com/apache/thrift@v0.23.1-0.20260429145742-d2acd3c49e58"}],"status":"fixed","timestamp":"2026-10-13T11:47:39.282606Z","vulnerability":{"name":"CVE-2026-43871"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:37:05.917756Z","products":[{"@id":"pkg:maven/org.bouncycastle/bc-fips@2.0.1"}],"status":"affected","timestamp":"2026-10-13T11:53:03.064189Z","vulnerability":{"name":"CVE-2026-8763"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:37:05.917756Z","products":[{"@id":"pkg:maven/org.bouncycastle/bc-fips@2.0.1"}],"status":"affected","timestamp":"2026-10-13T11:53:03.064525Z","vulnerability":{"name":"CVE-2026-13506"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:37:05.917756Z","products":[{"@id":"pkg:maven/org.bouncycastle/bc-fips@2.0.1"}],"status":"affected","timestamp":"2026-10-13T11:53:04.072071Z","vulnerability":{"name":"CVE-2026-13505"}}],"timestamp":"2026-09-04T12:55:43.893284668Z","tooling":"","version":29}