{"@context":"https://openvex.dev/ns/v0.2.0","@id":"pkg:docker/agent@7.83.2","author":"security@datadoghq.com","author_role":"Vulnerability Management","last_updated":"2026-10-13T13:13:19.307043017Z","statements":[{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:05.696821Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:05.696821Z","products":[{"@id":"pkg:generic/krb5@1.21.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:05.696821Z","vulnerability":{"name":"CVE-2007-5894"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:05.696908Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:05.696908Z","products":[{"@id":"pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.11"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:05.696908Z","vulnerability":{"name":"CVE-2026-73500"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:05.696963Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:05.696963Z","products":[{"@id":"pkg:generic/krb5@1.21.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:05.696963Z","vulnerability":{"name":"CVE-2026-40355"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:05.697014Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:05.697014Z","products":[{"@id":"pkg:generic/krb5@1.21.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:05.697014Z","vulnerability":{"name":"CVE-2026-40356"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:05.697055Z","impact_statement":"CVE-2018-10126 represents ZERO security risk to the Datadog Agent running on Ubuntu 24.04. Both Ubuntu and Debian security teams have assessed this as having no security impact, and the vulnerability cannot be reproduced in modern versions of the software.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T11:48:05.697055Z","products":[{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=libjpeg-turbo"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=libjpeg-turbo"}],"status":"not_affected","timestamp":"2026-10-13T11:48:05.697055Z","vulnerability":{"name":"CVE-2018-10126"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:05.697198Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:05.697198Z","products":[{"@id":"pkg:golang/golang.org/x/net@v0.58.0"},{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:05.697198Z","vulnerability":{"name":"CVE-2026-78663"}},{"action_statement":"This vulnerability was fixed in: 7.84.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"The vulnerability is only reachable through servers constructed via  xds.NewGRPCServer(). The datadog-agent does not import google.golang.org/grpc/xds anywhere in its codebase and constructs all internal gRPC servers using the standard grpc.NewServer() API. The vulnerable code is not present, making this vulnerability not exploitable. The dependency will be patched in newer versions of the image.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:03:12.492707Z","products":[{"@id":"pkg:golang/google.golang.org/grpc@v1.83.0"}],"status":"affected","timestamp":"2026-10-13T11:48:05.697554Z","vulnerability":{"name":"CVE-2026-84445"}},{"action_statement":"This vulnerability was fixed in: 7.84.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:03:12.492707Z","products":[{"@id":"pkg:golang/google.golang.org/grpc@v1.83.0"}],"status":"affected","timestamp":"2026-10-13T11:48:05.697687Z","vulnerability":{"name":"CVE-2026-84304"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:05.697828Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:05.697828Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:05.697828Z","vulnerability":{"name":"CVE-2026-56857"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:05.698Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:05.698Z","products":[{"@id":"pkg:golang/golang.org/x/net@v0.58.0"},{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:05.698Z","vulnerability":{"name":"CVE-2026-78659"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:05.698331Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:05.698331Z","products":[{"@id":"pkg:golang/golang.org/x/net@v0.58.0"},{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:05.698331Z","vulnerability":{"name":"CVE-2026-78669"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:05.698657Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:05.698657Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:05.698657Z","vulnerability":{"name":"CVE-2026-17084"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:05.698693Z","impact_statement":"False positive. The vulnerability only affects Python TLS servers whose sni_callback reassigns SSLSocket.context. The Datadog Agent and its integrations use Python's ssl module only as a TLS client (not as a server); no server-side SSLContext or sni_callback is used. So the vulnerable code is present in the embedded runtime but is never executed, and a remote client cannot trigger it.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:48:05.698693Z","products":[{"@id":"pkg:generic/python@3.13.15"},{"@id":"pkg:docker/agent@\u003cversion\u003e"}],"status":"not_affected","timestamp":"2026-10-13T11:48:05.698693Z","vulnerability":{"name":"CVE-2026-19445"}},{"action_statement":"This vulnerability was fixed in: 7.84.1","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:10:12.543492Z","products":[{"@id":"pkg:golang/golang.org/x/crypto@v0.55.0"}],"status":"affected","timestamp":"2026-10-13T11:48:05.698752Z","vulnerability":{"name":"CVE-2026-56855"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:05.69885Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:05.69885Z","products":[{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:05.69885Z","vulnerability":{"name":"CVE-2026-54873"}},{"action_statement":"This vulnerability was fixed in: 7.84.1","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:10:12.543492Z","products":[{"@id":"pkg:golang/golang.org/x/crypto@v0.55.0"}],"status":"affected","timestamp":"2026-10-13T11:48:05.698892Z","vulnerability":{"name":"CVE-2026-78662"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:05.699024Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:05.699024Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-10-13T11:48:05.699024Z","vulnerability":{"name":"CVE-2026-82560"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:05.699129Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:05.699129Z","products":[{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:05.699129Z","vulnerability":{"name":"CVE-2026-84782"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:05.699193Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:05.699193Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:05.699193Z","vulnerability":{"name":"CVE-2026-94440"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:05.69936Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:05.69936Z","products":[{"@id":"pkg:generic/python@3.13.15"},{"@id":"pkg:docker/agent@\u003cversion\u003e"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:05.69936Z","vulnerability":{"name":"CVE-2026-19553"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.565588Z","impact_statement":"","justification":"component_not_present","last_updated":"2026-10-13T11:48:06.565588Z","products":[{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"}],"status":"not_affected","timestamp":"2026-10-13T11:48:06.565588Z","vulnerability":{"name":"CVE-2026-84784"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.565669Z","impact_statement":"The vulnerability is in the Docker Engine daemon's plugin privilege validation (plugin/manager.go). The image contains no Docker daemon. The Agent binary links only github.com/docker/docker/pkg/system, an indirect Trivy dependency, and none of the plugin or daemon packages. The embedded module is also pinned to moby 28.x commit 31a1689cb0a1, which includes the backported fix 0afb41ce194c, and the module is declared at the patched version v29.3.1.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:48:06.565669Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"not_affected","timestamp":"2026-10-13T11:48:06.565669Z","vulnerability":{"name":"CVE-2026-33997"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.565767Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.565767Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.565767Z","vulnerability":{"name":"CVE-2026-97031"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.566109Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.566109Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.566109Z","vulnerability":{"name":"CVE-2026-15806"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.566179Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.566179Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.566179Z","vulnerability":{"name":"CVE-2026-78667"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.566365Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.566365Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.566365Z","vulnerability":{"name":"CVE-2026-87910"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.566407Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.566407Z","products":[{"@id":"pkg:generic/krb5@1.21.3"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.566407Z","vulnerability":{"name":"CVE-2007-3149"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.566458Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.566458Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.566458Z","vulnerability":{"name":"CVE-2026-19672"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:16:38.155718Z","products":[{"@id":"pkg:pypi/pip@26.1.1"}],"status":"affected","timestamp":"2026-10-13T11:48:06.566506Z","vulnerability":{"name":"CVE-2026-8643"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.566555Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.566555Z","products":[{"@id":"pkg:pypi/urllib3@2.7.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.566555Z","vulnerability":{"name":"CVE-2026-97689"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.566606Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.566606Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.566606Z","vulnerability":{"name":"CVE-2026-94439"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.566763Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.566763Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.566763Z","vulnerability":{"name":"CVE-2026-56866"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.566926Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.566926Z","products":[{"@id":"pkg:golang/golang.org/x/net@v0.58.0"},{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.566926Z","vulnerability":{"name":"CVE-2026-78660"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.567276Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.567276Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T11:48:06.567276Z","vulnerability":{"name":"CVE-2026-83357"}},{"action_statement":"This vulnerability was fixed in: 7.84.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:03:12.492707Z","products":[{"@id":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0"}],"status":"affected","timestamp":"2026-10-13T11:48:06.567352Z","vulnerability":{"name":"CVE-2026-81872"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.567392Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.567392Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.567392Z","vulnerability":{"name":"CVE-2026-101917"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.567435Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.567435Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.567435Z","vulnerability":{"name":"CVE-2026-102274"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.567473Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.567473Z","products":[{"@id":"pkg:golang/github.com/containerd/containerd/v2@v2.2.5"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.567473Z","vulnerability":{"name":"CVE-2026-53493"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.567558Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.567558Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T11:48:06.567558Z","vulnerability":{"name":"CVE-2026-83408"}},{"action_statement":"This vulnerability was fixed in: 7.83.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:55:03.238256Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-10-13T11:48:06.567647Z","vulnerability":{"name":"CVE-2026-19487"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.567729Z","impact_statement":"The vulnerability is a command injection via newlines in the `poplib` module (Python's POP3 email client library). No agent code uses `poplib`, the agent is an infrastructure monitoring tool with no email/POP3 functionality","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:48:06.567729Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"not_affected","timestamp":"2026-10-13T11:48:06.567729Z","vulnerability":{"name":"CVE-2025-15367"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.567768Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.567768Z","products":[{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.567768Z","vulnerability":{"name":"CVE-2026-72897"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.56781Z","impact_statement":"The ffmpeg-related packages identified in the scan are transitive dependencies introduced through the browser components used by the Synthetics worker. They are not directly invoked by Datadog application code, but are installed as part of the underlying operating system and Chrome dependencies required for browser-based test execution.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T11:48:06.56781Z","products":[{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"}],"status":"not_affected","timestamp":"2026-10-13T11:48:06.56781Z","vulnerability":{"name":"CVE-2025-1352"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.567873Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.567873Z","products":[{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:06.567873Z","vulnerability":{"name":"CVE-2026-75806"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.567916Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.567916Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T11:48:06.567916Z","vulnerability":{"name":"CVE-2026-86145"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.56799Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.56799Z","products":[{"@id":"pkg:pypi/pymongo@4.8.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.56799Z","vulnerability":{"name":"CVE-2026-96748"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.568027Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.568027Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.568027Z","vulnerability":{"name":"CVE-2026-101918"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.56806Z","impact_statement":"This is a false positive. The datadog/agent only uses PyJWT to sign outgoing RS256 assertions with a private key (DC/OS authentication, and Azure/MSAL and OAuth client credentials). It never verifies an incoming JWT with HMAC (HS*) allowed, so the bypassable check in HMACAlgorithm.prepare_key never runs (vulnerable code not present). The fix for this vulnerability will be present in v7.84.3 of the agent.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:48:06.56806Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"not_affected","timestamp":"2026-10-13T11:48:06.56806Z","vulnerability":{"name":"CVE-2026-102268"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.568102Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.568102Z","products":[{"@id":"pkg:pypi/urllib3@2.7.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.568102Z","vulnerability":{"name":"CVE-2026-97687"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.568201Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.568201Z","products":[{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.568201Z","vulnerability":{"name":"CVE-2026-75804"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.568263Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.568263Z","products":[{"@id":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=zlib"},{"@id":"pkg:deb/ubuntu/zlib1g@1.3.dfsg-3.1ubuntu2.2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:generic/zlib@1.3.2"},{"@id":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=zlib"},{"@id":"pkg:deb/ubuntu/zlib1g@1.3.dfsg-3.1ubuntu2.2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"}],"status":"affected","timestamp":"2026-10-13T11:48:06.568263Z","vulnerability":{"name":"CVE-2026-85091"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.568385Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.568385Z","products":[{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=libjpeg-turbo"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=libjpeg-turbo"}],"status":"affected","timestamp":"2026-10-13T11:48:06.568385Z","vulnerability":{"name":"CVE-2026-75466"}},{"action_statement":"This vulnerability was fixed in: 7.84.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:03:12.492707Z","products":[{"@id":"pkg:golang/google.golang.org/grpc@v1.83.0"}],"status":"affected","timestamp":"2026-10-13T11:48:06.56848Z","vulnerability":{"name":"CVE-2026-84303"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.568606Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.568606Z","products":[{"@id":"pkg:pypi/urllib3@2.7.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.568606Z","vulnerability":{"name":"CVE-2026-97688"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.568666Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.568666Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:06.568666Z","vulnerability":{"name":"CVE-2026-8674"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.568849Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.568849Z","products":[{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.568849Z","vulnerability":{"name":"CVE-2026-42772"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.568888Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.568888Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.568888Z","vulnerability":{"name":"CVE-2026-102265"}},{"action_statement":"This vulnerability was fixed in: 7.83.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:55:03.238256Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T11:48:06.568934Z","vulnerability":{"name":"CVE-2026-61308"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:16:38.155718Z","products":[{"@id":"pkg:pypi/pip@26.1.1"}],"status":"affected","timestamp":"2026-10-13T11:48:06.569005Z","vulnerability":{"name":"CVE-2026-13346"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.56905Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.56905Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.56905Z","vulnerability":{"name":"CVE-2026-82049"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.56909Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.56909Z","products":[{"@id":"pkg:pypi/pymongo@4.8.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.56909Z","vulnerability":{"name":"CVE-2026-88029"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.56918Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.56918Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T11:48:06.56918Z","vulnerability":{"name":"CVE-2026-89156"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.569291Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.569291Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:06.569291Z","vulnerability":{"name":"CVE-2026-97399"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.569474Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.569474Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T11:48:06.569474Z","vulnerability":{"name":"CVE-2026-94114"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.569562Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.569562Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T11:48:06.569562Z","vulnerability":{"name":"CVE-2026-89157"}},{"action_statement":"This vulnerability was fixed in: 7.83.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:55:03.238256Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T11:48:06.569635Z","vulnerability":{"name":"CVE-2026-70907"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.569705Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.569705Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"affected","timestamp":"2026-10-13T11:48:06.569705Z","vulnerability":{"name":"CVE-2026-103001"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.569753Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.569753Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T11:48:06.569753Z","vulnerability":{"name":"CVE-2026-83368"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.569815Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.569815Z","products":[{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:06.569815Z","vulnerability":{"name":"CVE-2026-35189"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.569859Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.569859Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.569859Z","vulnerability":{"name":"CVE-2026-102266"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.569896Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.569896Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.569896Z","vulnerability":{"name":"CVE-2026-102272"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.569935Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.569935Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.569935Z","vulnerability":{"name":"CVE-2026-15310"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.569977Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.569977Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.569977Z","vulnerability":{"name":"CVE-2026-102271"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.570021Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.570021Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T11:48:06.570021Z","vulnerability":{"name":"CVE-2026-89160"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.570103Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.570103Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:06.570103Z","vulnerability":{"name":"CVE-2026-89092"}},{"action_statement":"This vulnerability was fixed in: 7.83.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:55:03.238256Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T11:48:06.570304Z","vulnerability":{"name":"CVE-2026-60589"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.570372Z","impact_statement":"While the vulnerable libpam0g package is present in the Datadog Agent's Ubuntu base image, the Agent does not use PAM for authentication operations, making this vulnerability not exploitable in the Agent's context.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T11:48:06.570372Z","products":[{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.7?arch=all\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.7?arch=all\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"}],"status":"not_affected","timestamp":"2026-10-13T11:48:06.570372Z","vulnerability":{"name":"CVE-2024-10041"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.57064Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.57064Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.57064Z","vulnerability":{"name":"CVE-2026-102273"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.570699Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.570699Z","products":[{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.3?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.3?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:06.570699Z","vulnerability":{"name":"CVE-2016-2781"}},{"action_statement":"This vulnerability was fixed in: 7.83.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:55:03.238256Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-10-13T11:48:06.570763Z","vulnerability":{"name":"CVE-2026-15534"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.570906Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.570906Z","products":[{"@id":"pkg:deb/ubuntu/login@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/login@4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/passwd@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/passwd@4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/login@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/login@4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/passwd@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/passwd@4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"}],"status":"affected","timestamp":"2026-10-13T11:48:06.570906Z","vulnerability":{"name":"CVE-2024-56433"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.571249Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.571249Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32%2B9-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T11:48:06.571249Z","vulnerability":{"name":"CVE-2026-105111"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.571312Z","impact_statement":"The vulnerability is in the Docker Engine daemon's AuthZ plugin request forwarding (pkg/authorization/authz.go). The image contains no Docker daemon, and no binary links github.com/docker/docker/pkg/authorization. The Agent links only pkg/system, an indirect Trivy dependency. The embedded module is also pinned to moby 28.x commit 31a1689cb0a1, which includes both backported fixes (6d311e0d8d41 and db7dadaca041). The Agent uses the Docker API only as a client and never runs AuthZ middleware.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:48:06.571312Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"not_affected","timestamp":"2026-10-13T11:48:06.571312Z","vulnerability":{"name":"CVE-2026-34040"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.571362Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.571362Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T11:48:06.571362Z","vulnerability":{"name":"CVE-2026-89158"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.571437Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.571437Z","products":[{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.571437Z","vulnerability":{"name":"CVE-2026-35191"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.571486Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.571486Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.571486Z","vulnerability":{"name":"CVE-2026-102267"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.571677Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.571677Z","products":[{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:06.571677Z","vulnerability":{"name":"CVE-2026-75805"}},{"action_statement":"This vulnerability was fixed in: 7.84.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:03:12.492707Z","products":[{"@id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.20.0"}],"status":"affected","timestamp":"2026-10-13T11:48:06.571731Z","vulnerability":{"name":"CVE-2026-81871"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.571802Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.571802Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:06.571802Z","vulnerability":{"name":"CVE-2016-20013"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.572014Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.572014Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:06.572014Z","vulnerability":{"name":"CVE-2026-76642"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.573176Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.573176Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T11:48:06.573176Z","vulnerability":{"name":"CVE-2026-103111"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.573265Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.573265Z","products":[{"@id":"pkg:pypi/pymongo@4.8.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.573265Z","vulnerability":{"name":"CVE-2026-96749"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.573311Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.573311Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.573311Z","vulnerability":{"name":"CVE-2026-102270"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.573359Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.573359Z","products":[{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.573359Z","vulnerability":{"name":"CVE-2026-54875"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.573408Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.573408Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.573408Z","vulnerability":{"name":"CVE-2026-12345"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.573456Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.573456Z","products":[{"@id":"pkg:golang/github.com/containerd/containerd/v2@v2.2.5"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.573456Z","vulnerability":{"name":"CVE-2026-53495"}},{"action_statement":"This vulnerability was fixed in: 7.83.3","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:55:03.238256Z","products":[{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=sqlite3"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=sqlite3"}],"status":"affected","timestamp":"2026-10-13T11:48:06.573545Z","vulnerability":{"name":"CVE-2026-39113"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.573617Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.573617Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.573617Z","vulnerability":{"name":"CVE-2026-102269"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.573667Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.573667Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:06.573667Z","vulnerability":{"name":"CVE-2026-78408"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.574736Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.574736Z","products":[{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"}],"status":"affected","timestamp":"2026-10-13T11:48:06.574736Z","vulnerability":{"name":"CVE-2025-1376"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.574803Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.574803Z","products":[{"@id":"pkg:golang/golang.org/x/net@v0.58.0"},{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.574803Z","vulnerability":{"name":"CVE-2026-97032"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.575071Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.575071Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.575071Z","vulnerability":{"name":"CVE-2026-94448"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.575244Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.575244Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.575244Z","vulnerability":{"name":"CVE-2026-97030"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.575387Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.575387Z","products":[{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:06.575387Z","vulnerability":{"name":"CVE-2026-54872"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.575441Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.575441Z","products":[{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"}],"status":"affected","timestamp":"2026-10-13T11:48:06.575441Z","vulnerability":{"name":"CVE-2022-3219"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.575518Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.575518Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.575518Z","vulnerability":{"name":"CVE-2026-102275"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.57557Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.57557Z","products":[{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:06.57557Z","vulnerability":{"name":"CVE-2026-77696"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.575914Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.575914Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T11:48:06.575914Z","vulnerability":{"name":"CVE-2026-89162"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.575991Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.575991Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:06.575991Z","vulnerability":{"name":"CVE-2026-78410"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.57705Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.57705Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:06.57705Z","vulnerability":{"name":"CVE-2026-78409"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.578109Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.578109Z","products":[{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=acl"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=acl"}],"status":"affected","timestamp":"2026-10-13T11:48:06.578109Z","vulnerability":{"name":"CVE-2026-54369"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.578342Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.578342Z","products":[{"@id":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:06.578342Z","vulnerability":{"name":"CVE-2026-102474"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.578402Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.578402Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:06.578402Z","vulnerability":{"name":"CVE-2026-18374"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.578593Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.578593Z","products":[{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:06.578593Z","vulnerability":{"name":"CVE-2026-18508"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.578788Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.578788Z","products":[{"@id":"pkg:pypi/pymongo@4.8.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.578788Z","vulnerability":{"name":"CVE-2026-96747"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.57884Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.57884Z","products":[{"@id":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:06.57884Z","vulnerability":{"name":"CVE-2026-102473"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.578896Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.578896Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:06.578896Z","vulnerability":{"name":"CVE-2026-95818"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.579075Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.579075Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T11:48:06.579075Z","vulnerability":{"name":"CVE-2026-89161"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.579183Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.579183Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T11:48:06.579183Z","vulnerability":{"name":"CVE-2026-86805"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.579434Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.579434Z","products":[{"@id":"pkg:golang/github.com/moby/sys/user@v0.4.0"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.579434Z","vulnerability":{"name":"CVE-2026-61801"}},{"action_statement":"This vulnerability was fixed in: 7.84.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:03:12.492707Z","products":[{"@id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.44.0"},{"@id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.44.0"},{"@id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.44.0"},{"@id":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0"}],"status":"affected","timestamp":"2026-10-13T11:48:06.579501Z","vulnerability":{"name":"CVE-2026-81870"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.57965Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.57965Z","products":[{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=acl"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=acl"}],"status":"affected","timestamp":"2026-10-13T11:48:06.57965Z","vulnerability":{"name":"CVE-2026-54370"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.579719Z","impact_statement":"The Datadog Agent ships only libsystemd0, a shared utility library for client-side systemd APIs such as sd_notify. The journald daemon binary is entirely absent from the image.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:48:06.579719Z","products":[{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.17?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.17?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.17?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.17?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.17?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.17?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.17?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.17?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"}],"status":"not_affected","timestamp":"2026-10-13T11:48:06.579719Z","vulnerability":{"name":"CVE-2026-40228"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.579893Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.579893Z","products":[{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T11:48:06.579893Z","vulnerability":{"name":"CVE-2026-18477"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.579956Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.579956Z","products":[{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"}],"status":"affected","timestamp":"2026-10-13T11:48:06.579956Z","vulnerability":{"name":"CVE-2026-105712"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.58003Z","impact_statement":"While libbpf1 version 1.3.0-2build2 is installed and IS vulnerable, the Datadog Agent does not use libbpf. Additionally, the vulnerability is disputed by maintainers as it requires root privileges to trigger.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T11:48:06.58003Z","products":[{"@id":"pkg:deb/ubuntu/libbpf1@1.3.0-2build2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libbpf1@1%3A1.3.0-2build2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=libbpf%401.3.0-2build2"},{"@id":"pkg:deb/ubuntu/libbpf1@1.3.0-2build2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libbpf1@1%3A1.3.0-2build2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=libbpf%401.3.0-2build2"}],"status":"not_affected","timestamp":"2026-10-13T11:48:06.58003Z","vulnerability":{"name":"CVE-2025-29481"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.580102Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.580102Z","products":[{"@id":"pkg:pypi/oauthlib@3.3.1"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.580102Z","vulnerability":{"name":"CVE-2026-49264"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.580183Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.580183Z","products":[{"@id":"pkg:pypi/oauthlib@3.3.1"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.580183Z","vulnerability":{"name":"CVE-2026-49265"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.580227Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.580227Z","products":[{"@id":"pkg:cargo/rustls@0.23.41"}],"status":"under_investigation","timestamp":"2026-10-13T11:48:06.580227Z","vulnerability":{"name":"GHSA-2mjx-qc3c-rqvc"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.580265Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.580265Z","products":[{"@id":"pkg:pypi/tuf@4.0.0"}],"status":"affected","timestamp":"2026-10-13T11:48:06.580265Z","vulnerability":{"name":"GHSA-qp9x-wp8f-qgjj"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.58029Z","impact_statement":"The advisory affects only golang.org/x/crypto/openpgp, which is deprecated    and will not be fixed. The Datadog Agent depends on the golang.org/x/crypto module only for    golang.org/x/crypto/nacl/box (via pkg/fleet/daemon). The openpgp package is never imported,    directly or indirectly, so it is not compiled into any Agent binary: a full package-graph check    (go list -deps ./... for linux, windows and darwin) finds no golang.org/x/crypto/openpgp package.    The Agent's PGP/GPG code (comp/metadata/packagesigning/impl/readgpg.go and    pkg/util/kernel/headers/download/rpm/dnfv2/repo/repo.go) already uses the recommended replacement,   github.com/ProtonMail/go-crypto/openpgp. No action is needed.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T11:48:06.58029Z","products":[{"@id":"pkg:golang/golang.org/x/crypto@v0.55.0"}],"status":"not_affected","timestamp":"2026-10-13T11:48:06.58029Z","vulnerability":{"name":"GO-2026-5932"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:16:38.155718Z","products":[{"@id":"pkg:cargo/faster-hex@0.10.0"}],"status":"affected","timestamp":"2026-10-13T11:48:06.580362Z","vulnerability":{"name":"RUSTSEC-2026-0306"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.580413Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.580413Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"affected","timestamp":"2026-10-13T11:48:06.580413Z","vulnerability":{"name":"GO-2026-5617"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.580449Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.580449Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"affected","timestamp":"2026-10-13T11:48:06.580449Z","vulnerability":{"name":"GO-2026-5668"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.580478Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.580478Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"affected","timestamp":"2026-10-13T11:48:06.580478Z","vulnerability":{"name":"GO-2026-5746"}},{"action_statement":"This vulnerability was fixed in: 7.84.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:03:12.492707Z","products":[{"@id":"pkg:golang/github.com/google/cel-go@v0.29.2"}],"status":"affected","timestamp":"2026-10-13T11:48:06.580504Z","vulnerability":{"name":"GO-2026-6094"}},{"action_statement":"This vulnerability was fixed in: 7.84.0","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:03:12.492707Z","products":[{"@id":"pkg:cargo/h2@0.4.14"}],"status":"affected","timestamp":"2026-10-13T11:48:06.580536Z","vulnerability":{"name":"RUSTSEC-2026-0258"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T11:48:06.580567Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.580567Z","products":[{"@id":"pkg:cargo/unsafe-libyaml@0.2.11"}],"status":"affected","timestamp":"2026-10-13T11:48:06.580567Z","vulnerability":{"name":"RUSTSEC-2024-0449"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-19931"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-80231"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-18924"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-80229"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-13608"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:golang/golang.org/x/crypto@v0.54.0"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-56854"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-82208"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-82209"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-80230"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:golang/golang.org/x/text@v0.40.0"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-56851"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:golang/golang.org/x/mod@v0.38.0"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-56864"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-77117"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-80489"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-19499"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-19542"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-6791"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:golang/golang.org/x/mod@v0.38.0"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-56865"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T11:48:06.684284Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"fixed","timestamp":"2026-10-13T11:48:06.684284Z","vulnerability":{"name":"CVE-2026-6368"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.377083Z","impact_statement":"CVE-2025-6965 is a memory corruption vulnerability in SQLite \u003c 3.50.2. The Datadog Windows agent image is not vulnerable: the embedded CPython build is explicitly pinned to SQLite 3.53.0, and the Go SQLite modules (mattn/go-sqlite3, modernc.org/sqlite, glebarez/go-sqlite) are gated behind LINUX_ONLY_TAGS and are never compiled into Windows builds. The only winsqlite3.dll present belongs to the Windows Server 2019 OS base layer which is never loaded by the agent process","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:13.377083Z","products":[{"@id":"pkg:generic/sqlite@3.43.2"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.377083Z","vulnerability":{"name":"CVE-2025-6965"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.377154Z","impact_statement":"The product is not affected by CVE-2019-16294 as the vulnerable component SciLexer.dll is not present","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:05:13.377154Z","products":[{"@id":"pkg:generic/scintilla@4.4.6"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.377154Z","vulnerability":{"name":"CVE-2019-16294"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.377251Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.377251Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:05:13.377251Z","vulnerability":{"name":"CVE-2025-30761"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.377289Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK base image. no CMP symbols are even linked into the flagged DLLs in the agent. The Agent's own OpenSSL libraries include the fix.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:05:13.377289Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.377289Z","vulnerability":{"name":"CVE-2026-63076"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.377356Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK Nano Server base image. The flagged libcrypto DLL does not contain the vulnerable code. The only MinGit binary that loads libssl (libcurl-openssl-4.dll) never calls any RPK API. The Datadog Agent never runs git or MinGit. The Agent's own OpenSSL libraries are fixed.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:05:13.377356Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.377356Z","vulnerability":{"name":"CVE-2026-18798"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.377424Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK base image. no CMP symbols are even linked into the flagged DLLs in the agent. The Agent's own OpenSSL libraries include the fix.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:05:13.377424Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.377424Z","vulnerability":{"name":"CVE-2026-63073"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.377491Z","impact_statement":"CVE-2026-8925 is a double free in curl's libgsasl-based SASL code (IMAP, POP3 and SMTP) and affects curl 8.15.0 to 8.20.0 only when curl is built with libgsasl. The flagged C:\\\\Windows\\\\System32\\\\curl.exe is Microsoft's inbox curl tool. On 1809 and ltsc2022 it is 8.13.0, which predates the bug. On ltsc2025 it is 8.16.0 but built without libgsasl: there is no libgsasl version component or import, so the vulnerable code is absent. The binary ships in the Microsoft base OS layer, and the Datadog Agent never runs it.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:13.377491Z","products":[{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.377491Z","vulnerability":{"name":"CVE-2026-8925"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.378249Z","impact_statement":"The agent uses Java for JMXFetch which runs only trusted, administrator-installed code to gather metrics from JMX-enabled applications making the exploitation scenario described in this CVE inapplicable to the agent's use case.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:05:13.378249Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.378249Z","vulnerability":{"name":"CVE-2025-30749"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.378322Z","impact_statement":"CVE-2026-6473 is a PostgreSQL **server-side** integer wraparound vulnerability. The Datadog Agent does not ship or run a PostgreSQL server.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:13.378322Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.378322Z","vulnerability":{"name":"CVE-2026-6473"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.378355Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK Nano Server base image. The flagged libcrypto DLL does not contain the vulnerable code. The only MinGit binary that loads libssl (libcurl-openssl-4.dll) never calls any RPK API. The Datadog Agent never runs git or MinGit. The Agent's own OpenSSL libraries are fixed.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:05:13.378355Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.378355Z","vulnerability":{"name":"CVE-2026-14457"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.37847Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.37847Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.37847Z","vulnerability":{"name":"CVE-2026-3805"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.378506Z","impact_statement":"Oracle's advisory explicitly exempts server-side Java deployments running trusted code and the Datadog Agent JMX fetcher is a server-side process running only the trusted jmxfetch.jar","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:05:13.378506Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.378506Z","vulnerability":{"name":"CVE-2026-21945"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.378634Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK base image. The flagged libssl DLL contains no CMS code. No MinGit binary that loads either libcrypto copy (libcurl, the OpenSSL engines and providers, OpenSSH, Heimdal, FIDO2) references any CMS function. The Datadog Agent never runs git or MinGit, and the Agent's own OpenSSL libraries include the fix.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:05:13.378634Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.378634Z","vulnerability":{"name":"CVE-2026-63072"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.37887Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.37887Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:05:13.37887Z","vulnerability":{"name":"CVE-2026-34282"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.378956Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.378956Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.378956Z","vulnerability":{"name":"CVE-2026-11856"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.379028Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.379028Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.379028Z","vulnerability":{"name":"CVE-2025-21587"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.379063Z","impact_statement":"CVE-2026-8924 is a bypass of curl's Public Suffix List (libpsl) cookie-scope check, using trailing-dot host names and cookie domains. The curl project scopes it to PSL-enabled builds, and notes that builds without PSL never perform this protection in the first place. The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 and 8.16.0) is Microsoft's inbox curl tool from the Windows Nano Server base OS layer, built without libpsl: there are 0 'libpsl' or 'psl_' strings, no 'libpsl/%s' component in curl_version() (only 'zlib/%s'), and no PSL library import. The 'PSL' token in the binary is curl's static feature-name table. The PSL check code containing the flaw is therefore not present. The Datadog Agent also never runs curl.exe.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:13.379063Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.379063Z","vulnerability":{"name":"CVE-2026-8924"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.3791Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK base image. the Datadog Agent's own code contains no QUIC implementation of any kind. The only MinGit consumer of libssl (libcurl-openssl-4.dll) references only TLS_client_method and TLS_method, and the Agent never runs git or MinGit. The Agent's own OpenSSL libraries include the fix","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:05:13.3791Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.3791Z","vulnerability":{"name":"CVE-2026-63075"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.379328Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.379328Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.379328Z","vulnerability":{"name":"CVE-2026-10536"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.3794Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.3794Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.3794Z","vulnerability":{"name":"CVE-2026-16239"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.37944Z","impact_statement":"CVE-2026-9079 is a libcurl flaw where clearing proxy authentication credentials on a reused handle does not take effect, so later transfers reuse stale proxy credentials. The curl project states: 'This flaw does not affect the curl command line tool.' The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 on 1809/ltsc2022, 8.16.0 on ltsc2025) is Microsoft's inbox curl command-line tool from the Windows Nano Server base OS layer, built with Schannel. The Datadog Agent never runs curl.exe. No application in the image uses it as a library, so the affected libcurl handle-reuse path is never exercised.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:05:13.37944Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.37944Z","vulnerability":{"name":"CVE-2026-9079"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.379475Z","impact_statement":"OpenSSL is used exclusively as a CLI tool (e.g., certificate operations) and is never run as a QUIC server. The Agent does not implement QUIC/HTTP3 in any form, so the vulnerable code path is not present, making it not exploitable.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:13.379475Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.379475Z","vulnerability":{"name":"CVE-2026-14456"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.379584Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.379584Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:05:13.379584Z","vulnerability":{"name":"CVE-2025-50106"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.379647Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.379647Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.379647Z","vulnerability":{"name":"CVE-2026-14669"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.379827Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.379827Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:05:13.379827Z","vulnerability":{"name":"CVE-2026-22016"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.379882Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.379882Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:05:13.379882Z","vulnerability":{"name":"CVE-2025-53066"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.380562Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.380562Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.380562Z","vulnerability":{"name":"CVE-2025-21502"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.380863Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.380863Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.380863Z","vulnerability":{"name":"CVE-2026-5773"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.380912Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK Nano Server base image. CVE-2026-54874 affects only DTLS endpoints that buffer future-epoch records during a handshake. No binary in the image uses DTLS. The only MinGit consumer of libssl (libcurl-openssl-4.dll) references only TLS_client_method and TLS_method, and the Agent never runs git or MinGit. The Agent's own OpenSSL libraries include the fix.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:05:13.380912Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.380912Z","vulnerability":{"name":"CVE-2026-54874"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.381258Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.381258Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:05:13.381258Z","vulnerability":{"name":"CVE-2025-50059"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.381302Z","impact_statement":"the vulnerable curl.exe is part of the Microsoft Windows base OS layer. The Datadog Agent never runs it: no Agent code, entrypoint or install script calls curl.exe, and the Agent's HTTP clients are Go net/http, not libcurl. The vulnerability needs curl to open a WebSocket connection to a malicious server, which the product never does. The finding will clear when Microsoft ships a patched ltsc2025 base image.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:05:13.381302Z","products":[{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.381302Z","vulnerability":{"name":"CVE-2026-11586"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.381338Z","impact_statement":"CVE-2026-8927 is a libcurl flaw in which reusing one easy handle for sequential transfers through different environment-configured proxies leaks a Digest Proxy-Authorization header to the second proxy. The curl project states that it does not affect the curl command-line tool. The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 and 8.16.0) is that command-line tool, Microsoft's inbox build from the Windows Nano Server base OS layer. It is not a libcurl library exposed to applications. No application in the image loads it as a library, and the Datadog Agent never runs curl.exe, so the affected handle-reuse path is never exercised.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:13.381338Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.381338Z","vulnerability":{"name":"CVE-2026-8927"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.381414Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.381414Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.381414Z","vulnerability":{"name":"CVE-2026-15742"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.381471Z","impact_statement":"CVE-2026-6479 is an uncontrolled recursion vulnerability in the PostgreSQL server-side SSL/GSS connection negotiation path. The Datadog Agent bundle the PostgreSQL client wire-protocol library","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:13.381471Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.381471Z","vulnerability":{"name":"CVE-2026-6479"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.38246Z","impact_statement":"CVE-2026-6478 is a covert timing-channel vulnerability in the PostgreSQL server's MD5 password-comparison routine during client authentication. The Datadog agent image does not ship or run a PostgreSQL server","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:13.38246Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.38246Z","vulnerability":{"name":"CVE-2026-6478"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.382539Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.382539Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.382539Z","vulnerability":{"name":"CVE-2026-6253"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.382807Z","impact_statement":"C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 and 8.16.0) is Microsoft's inbox curl tool in the Nano Server base OS layer. It includes the affected .netrc credential lookup (curl 8.11.1 to 8.20.0). The flaw is triggered only when a user runs curl with netrc enabled against a URL that has a username but no password, while .netrc holds another user's credentials for the same host. The Datadog Agent never runs curl.exe, has no code path that passes netrc options to it, and ships no .netrc file, so the vulnerable code is never run by the product.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:13.382807Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.382807Z","vulnerability":{"name":"CVE-2026-8926"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.383057Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.383057Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.383057Z","vulnerability":{"name":"CVE-2025-14819"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.383116Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.383116Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.383116Z","vulnerability":{"name":"CVE-2026-6471"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.383194Z","impact_statement":"Oracle advisory explicitly excludes server deployments; AWT/JavaFX not used; UI:R unsatisfiable","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:05:13.383194Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.383194Z","vulnerability":{"name":"CVE-2026-21932"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.383265Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.383265Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.383265Z","vulnerability":{"name":"CVE-2026-15741"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.383445Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.383445Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.383445Z","vulnerability":{"name":"CVE-2026-14662"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.383485Z","impact_statement":"CVE-2026-9080 is a libcurl use-after-free triggered only when an application calls curl_easy_pause() from inside the multi interface's event-based CURLMOPT_SOCKETFUNCTION callback. The curl project states: 'This flaw does not affect the curl command line tool.' The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 on 1809/ltsc2022, 8.16.0 on ltsc2025) is Microsoft's inbox curl command-line tool from the Windows Nano Server base OS layer, built with Schannel. The Datadog Agent never runs curl.exe. The tool does not install such a callback, and no application in the image uses it as a library, so the vulnerable path is never exercised.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:05:13.383485Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.383485Z","vulnerability":{"name":"CVE-2026-9080"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.383532Z","impact_statement":"A server superuser would need to force the agent to call the non-existent lo_read() code path. However no code path in the agent ever calls PQfn() or any lo_* function.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:05:13.383532Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.383532Z","vulnerability":{"name":"CVE-2026-6477"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.383592Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.383592Z","products":[{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.383592Z","vulnerability":{"name":"CVE-2026-80255"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.38382Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.38382Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.38382Z","vulnerability":{"name":"CVE-2026-14664"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.383883Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.383883Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.383883Z","vulnerability":{"name":"CVE-2026-14670"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.383942Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.383942Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.383942Z","vulnerability":{"name":"CVE-2026-14676"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.384Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.384Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.384Z","vulnerability":{"name":"CVE-2026-47057"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.38408Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.38408Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.38408Z","vulnerability":{"name":"CVE-2025-14524"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.384153Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.384153Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.384153Z","vulnerability":{"name":"CVE-2026-19385"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.384479Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.384479Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.384479Z","vulnerability":{"name":"CVE-2026-14677"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.384537Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.384537Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.384537Z","vulnerability":{"name":"CVE-2026-14680"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.384595Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.384595Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.384595Z","vulnerability":{"name":"CVE-2026-14671"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.384659Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.384659Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.384659Z","vulnerability":{"name":"CVE-2026-16238"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.384712Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.384712Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.384712Z","vulnerability":{"name":"CVE-2025-30698"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.38487Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK base image. no CMP symbols are even linked into the flagged DLLs in the agent. The Agent's own OpenSSL libraries include the fix.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:05:13.38487Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.38487Z","vulnerability":{"name":"CVE-2026-63074"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.385279Z","impact_statement":"CVE-2026-9545 (HTTP/3 early data exposed to an impostor server) is specific to curl built with the ngtcp2 + nghttp3 HTTP/3 backend, with TLS early data enabled. The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 on 1809/ltsc2022, 8.16.0 on ltsc2025) is Microsoft's inbox curl command-line tool from the Windows Nano Server base OS layer, built with Schannel. The Datadog Agent never runs curl.exe. It contains no HTTP/3 backend: there are 0 occurrences of ngtcp2, nghttp3, quiche, msh3 or OpenSSL-QUIC and no corresponding version components (the '--http3' and 'HTTP/3' strings are generic tool help and option text). The vulnerable HTTP/3 code is therefore not present.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:13.385279Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"not_affected","timestamp":"2026-10-13T12:05:13.385279Z","vulnerability":{"name":"CVE-2026-9545"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:13.38547Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:13.38547Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:13.38547Z","vulnerability":{"name":"CVE-2026-7168"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.35734Z","impact_statement":"CVE-2026-6637 is a stack buffer overflow and SQL injection vulnerability in the PostgreSQL server-side `refint` contrib module, requiring an active PostgreSQL server with `refint` triggers installed to exploit which the Datadog agent does not embed.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:14.35734Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:05:14.35734Z","vulnerability":{"name":"CVE-2026-6637"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.357492Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:14.357492Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:14.357492Z","vulnerability":{"name":"CVE-2026-12064"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.357565Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:14.357565Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:14.357565Z","vulnerability":{"name":"CVE-2026-8932"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.357854Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:14.357854Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:14.357854Z","vulnerability":{"name":"CVE-2026-5545"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.357908Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:14.357908Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:05:14.357908Z","vulnerability":{"name":"CVE-2026-41254"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.358063Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:14.358063Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:05:14.358063Z","vulnerability":{"name":"CVE-2025-53057"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.358334Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:14.358334Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:14.358334Z","vulnerability":{"name":"CVE-2026-18408"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.358383Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:14.358383Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:14.358383Z","vulnerability":{"name":"CVE-2026-47058"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.358675Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:14.358675Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:14.358675Z","vulnerability":{"name":"CVE-2025-15079"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.358736Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:14.358736Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:14.358736Z","vulnerability":{"name":"CVE-2026-6464"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.358965Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:14.358965Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:14.358965Z","vulnerability":{"name":"CVE-2026-3783"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.359021Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:14.359021Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:14.359021Z","vulnerability":{"name":"CVE-2026-3784"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.359456Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:14.359456Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:14.359456Z","vulnerability":{"name":"CVE-2026-47063"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.359496Z","impact_statement":"The Datadog Agent does not ship or run a PostgreSQL server","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:14.359496Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:05:14.359496Z","vulnerability":{"name":"CVE-2026-6475"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.359551Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:14.359551Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:14.359551Z","vulnerability":{"name":"CVE-2026-6429"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.359605Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:14.359605Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:14.359605Z","vulnerability":{"name":"CVE-2026-6276"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.359661Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:14.359661Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:14.359661Z","vulnerability":{"name":"CVE-2026-14668"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.359746Z","impact_statement":"CVE-2026-9547 (SSH host key type mismatch accepted) affects only libcurl built with the libssh backend, for SCP/SFTP transfers using CURLOPT_SSH_KEYFUNCTION. The curl project states that libssh2 builds are not affected and that the flaw does not affect the curl command line tool. The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 on 1809/ltsc2022, 8.16.0 on ltsc2025) is Microsoft's inbox curl command-line tool from the Windows Nano Server base OS layer, built with Schannel. The Datadog Agent never runs curl.exe. It contains no libssh backend: there are 0 'libssh' strings, 0 ssh_* API references and no 'libssh/%s' component (the single 'libssh2' token is curl's static feature-name table). The vulnerable code is therefore not present, and the binary is the unaffected command-line tool.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:14.359746Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"not_affected","timestamp":"2026-10-13T12:05:14.359746Z","vulnerability":{"name":"CVE-2026-9547"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.35982Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:14.35982Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:14.35982Z","vulnerability":{"name":"CVE-2026-8286"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:14.360179Z","impact_statement":"The Datadog Agent Windows image (\u003e7.82.0) ships three separate SQLite consumers: the embedded Python 3 `sqlite3.dll`, and the Go-based `mattn/go-sqlite3` and `modernc.org/sqlite` libraries used by the Agent binary and none of them are affected: (1) every embedded SQLite version is already ≥3.53.0, well past the fixed version 3.51.1, and (2) the `zipfile` extension is an optional, non-default SQLite component that is not compiled into any of these builds (zero occurrences of `zipfileInflate`/`zipfileModule`/`SQLITE_ENABLE_ZIPFILE` in any binary or source we inspected). This mirrors Debian's own tracker classification of \"unimportant,\" which notes the zipfile extension isn't built into their SQLite packages either.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:14.360179Z","products":[{"@id":"pkg:generic/sqlite@3.43.2"}],"status":"not_affected","timestamp":"2026-10-13T12:05:14.360179Z","vulnerability":{"name":"CVE-2025-70873"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.131672Z","impact_statement":"","justification":"component_not_present","last_updated":"2026-10-13T12:05:16.131672Z","products":[{"@id":"pkg:generic/sqlite@3.43.2"},{"@id":"pkg:generic/sqlite@3.51.1"}],"status":"not_affected","timestamp":"2026-10-13T12:05:16.131672Z","vulnerability":{"name":"CVE-2026-11822"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.131983Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:16.131983Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:16.131983Z","vulnerability":{"name":"CVE-2026-14679"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.132489Z","impact_statement":"The Datadog Agent does not load or run untrusted Java code and is not a sandboxed Java runtime for customer applications. Accordingly, under normal and supported usage, Datadog has identified no viable exploit path for these vulnerabilities","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:05:16.132489Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-10-13T12:05:16.132489Z","vulnerability":{"name":"CVE-2025-30754"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.132681Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:16.132681Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:16.132681Z","vulnerability":{"name":"CVE-2026-8458"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.132851Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:16.132851Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:16.132851Z","vulnerability":{"name":"CVE-2026-47021"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.132904Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:16.132904Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:16.132904Z","vulnerability":{"name":"CVE-2026-6476"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.132944Z","impact_statement":"MinGit bundled in datadog agent \u003e= 7.83.3 (windows/amd64), inherited unmodified from the upstream microsoft base image, ships OpenSSL 3.5.7, which is genuinely inside the vulnerable range for CVE-2026-75803 (fixed in 3.5.8) and not yet remediated upstream by Microsoft. However, the flaw only manifests for callers that invoke the low-level, deprecated one-shot EVP_Cipher() API directly for AES-OCB/ChaCha20-Poly1305 AEAD decryption of an empty ciphertext and trust its return code alone as tag validation. MinGit's only consumers, git.exe and curl.exe, perform TLS exclusively through OpenSSL's standard high-level record-layer/EVP_DecryptUpdate+Final path and never call EVP_Cipher() for AEAD operations, and neither implements any custom AEAD message-forgery-checking logic of its own. The vulnerable code path is therefore never reached in this deployment, regardless of the outstanding version gap.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:16.132944Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:05:16.132944Z","vulnerability":{"name":"CVE-2026-75803"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.133214Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:16.133214Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:16.133214Z","vulnerability":{"name":"CVE-2026-46917"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.133264Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:16.133264Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:16.133264Z","vulnerability":{"name":"CVE-2026-47027"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.133307Z","impact_statement":"This vulnerability detection is a false positive caused by overly broad CPE matching in vulnerability databases. The CVE does not apply to the Windows Datadog Agent.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:16.133307Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:05:16.133307Z","vulnerability":{"name":"CVE-2017-8806"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.133866Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:16.133866Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:16.133866Z","vulnerability":{"name":"CVE-2026-4873"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.13397Z","impact_statement":"The Datadog Agent does not ship or run a PostgreSQL server","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:16.13397Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:05:16.13397Z","vulnerability":{"name":"CVE-2026-6638"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.13469Z","impact_statement":"This vulnerability cannot be exploited in the Datadog Agent container. MinGit is an unused component from the PowerShell base image with proper ACL protections. The container security model eliminates the attack surface required for exploitation.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:05:16.13469Z","products":[{"@id":"pkg:generic/msys2@3.6.10-710e5275eb86d54b45b5f4d71ecc4e1cac1b9302"}],"status":"not_affected","timestamp":"2026-10-13T12:05:16.13469Z","vulnerability":{"name":"CVE-2022-37172"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.13499Z","impact_statement":"The UI:R (user interaction required) prerequisite is structurally unsatisfiable in a containerized agent service, and the attack path described targets sandboxed client deployments","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:05:16.13499Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-10-13T12:05:16.13499Z","vulnerability":{"name":"CVE-2026-21933"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.135037Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:16.135037Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:16.135037Z","vulnerability":{"name":"CVE-2026-60147"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.135079Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:16.135079Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:16.135079Z","vulnerability":{"name":"CVE-2026-46968"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.135125Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:16.135125Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:05:16.135125Z","vulnerability":{"name":"CVE-2026-22021"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.13532Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:16.13532Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:16.13532Z","vulnerability":{"name":"CVE-2026-6470"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.135378Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:16.135378Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:16.135378Z","vulnerability":{"name":"CVE-2026-1965"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.135665Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:16.135665Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:16.135665Z","vulnerability":{"name":"CVE-2025-15224"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.135711Z","impact_statement":"The Datadog Agent contains no PostgreSQL server binaries. The agent bundles only the psycopg Python client library and its libpq dependency on Linux builds; the Windows build contains neither","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:16.135711Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:05:16.135711Z","vulnerability":{"name":"CVE-2026-6474"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.135817Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:16.135817Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:16.135817Z","vulnerability":{"name":"CVE-2026-6575"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:16.135897Z","impact_statement":"The vulnerability affects the `mimetypes` module's use of Unix-style paths on Windows. No agent code uses `mimetypes` and no local users exist in the container","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:05:16.135897Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"not_affected","timestamp":"2026-10-13T12:05:16.135897Z","vulnerability":{"name":"CVE-2024-3220"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.023999Z","impact_statement":"","justification":"component_not_present","last_updated":"2026-10-13T12:05:17.023999Z","products":[{"@id":"pkg:generic/sqlite@3.43.2"},{"@id":"pkg:generic/sqlite@3.51.1"}],"status":"not_affected","timestamp":"2026-10-13T12:05:17.023999Z","vulnerability":{"name":"CVE-2026-11824"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.025032Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.025032Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:05:17.025032Z","vulnerability":{"name":"CVE-2026-22013"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.02518Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.02518Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:17.02518Z","vulnerability":{"name":"CVE-2025-13034"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.025263Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.025263Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:17.025263Z","vulnerability":{"name":"CVE-2026-14672"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.025331Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.025331Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:17.025331Z","vulnerability":{"name":"CVE-2026-21925"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.025383Z","impact_statement":"This vulnerability lives entirely in PostgreSQL's DDL privilege-checking code and has no client-library component. The Datadog Agent bundles only `libpq` a client wire-protocol library that contains no DDL authorization logic.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:05:17.025383Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:05:17.025383Z","vulnerability":{"name":"CVE-2026-6472"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.026041Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.026041Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:17.026041Z","vulnerability":{"name":"CVE-2026-6469"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.026088Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.026088Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:17.026088Z","vulnerability":{"name":"CVE-2026-47059"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.026842Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.026842Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:17.026842Z","vulnerability":{"name":"CVE-2026-14678"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.026904Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.026904Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:17.026904Z","vulnerability":{"name":"CVE-2026-18024"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.027673Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.027673Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:05:17.027673Z","vulnerability":{"name":"CVE-2026-22018"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.028087Z","impact_statement":"The Datadog Agent's Go binary uses Go's standard library `compress/zlib` (pure Go, no linkage to system libz), and Python's `zlib` module, while linking against system libz, does not expose `crc32_combine64` to Python userspace.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:05:17.028087Z","products":[{"@id":"pkg:generic/zlib@1.3.1"}],"status":"not_affected","timestamp":"2026-10-13T12:05:17.028087Z","vulnerability":{"name":"CVE-2026-27171"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.02815Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.02815Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:17.02815Z","vulnerability":{"name":"CVE-2026-47010"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.028539Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.028539Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:17.028539Z","vulnerability":{"name":"CVE-2026-14666"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.028596Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.028596Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:05:17.028596Z","vulnerability":{"name":"CVE-2026-23865"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.028662Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.028662Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:17.028662Z","vulnerability":{"name":"CVE-2026-16241"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.028818Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.028818Z","products":[{"@id":"pkg:generic/curl@8.16.0"},{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:17.028818Z","vulnerability":{"name":"CVE-2025-14017"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.028977Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.028977Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:17.028977Z","vulnerability":{"name":"CVE-2026-14673"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.029044Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.029044Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:17.029044Z","vulnerability":{"name":"CVE-2026-14663"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.029282Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.029282Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:05:17.029282Z","vulnerability":{"name":"CVE-2026-34268"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.029341Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.029341Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:05:17.029341Z","vulnerability":{"name":"CVE-2026-22007"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.029426Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.029426Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:17.029426Z","vulnerability":{"name":"CVE-2026-14681"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:05:17.029766Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.029766Z","products":[{"@id":"pkg:nuget/NuGet.Packaging@6.14.3-rc.1"},{"@id":"pkg:nuget/NuGet.Protocol@6.14.3-rc.1"}],"status":"under_investigation","timestamp":"2026-10-13T12:05:17.029766Z","vulnerability":{"name":"GHSA-g4vj-cjjj-v7hg"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.157815Z","products":[{"@id":"pkg:nuget/Microsoft.AspNetCore.Server.IISIntegration@9.0.19"}],"status":"fixed","timestamp":"2026-10-13T12:05:17.157815Z","vulnerability":{"name":"CVE-2026-69304"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.157815Z","products":[{"@id":"pkg:generic/openssl@3.6.3"}],"status":"fixed","timestamp":"2026-10-13T12:05:17.157815Z","vulnerability":{"name":"CVE-2026-54876"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:05:17.157815Z","products":[{"@id":"pkg:generic/git@2.55.0.windows.3"}],"status":"fixed","timestamp":"2026-10-13T12:05:17.157815Z","vulnerability":{"name":"CVE-2026-62960"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:37:05.917756Z","products":[{"@id":"pkg:maven/org.bouncycastle/bc-fips@2.0.1"}],"status":"affected","timestamp":"2026-10-13T12:09:59.796826Z","vulnerability":{"name":"CVE-2026-8763"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:37:05.917756Z","products":[{"@id":"pkg:maven/org.bouncycastle/bc-fips@2.0.1"}],"status":"affected","timestamp":"2026-10-13T12:09:59.797116Z","vulnerability":{"name":"CVE-2026-13506"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:37:05.917756Z","products":[{"@id":"pkg:maven/org.bouncycastle/bc-fips@2.0.1"}],"status":"affected","timestamp":"2026-10-13T12:10:00.633218Z","vulnerability":{"name":"CVE-2026-13505"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:10:00.646322Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:10:00.646322Z","products":[{"@id":"pkg:golang/github.com/aws/aws-sdk-go@v1.55.8"}],"status":"affected","timestamp":"2026-10-13T12:10:00.646322Z","vulnerability":{"name":"GO-2022-0635"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:10:00.646354Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:10:00.646354Z","products":[{"@id":"pkg:golang/github.com/aws/aws-sdk-go@v1.55.8"}],"status":"affected","timestamp":"2026-10-13T12:10:00.646354Z","vulnerability":{"name":"GO-2022-0646"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:08:54.325058Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:54.325058Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:08:54.325058Z","vulnerability":{"name":"CVE-2025-9086"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:08:54.325107Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:54.325107Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:08:54.325107Z","vulnerability":{"name":"CVE-2025-5399"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:08:54.325383Z","impact_statement":"The Datadog Agent has no MimeKit dependency and sends no SMTP mail","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:08:54.325383Z","products":[{"@id":"pkg:nuget/MimeKit@4.3.0.0"}],"status":"not_affected","timestamp":"2026-10-13T12:08:54.325383Z","vulnerability":{"name":"CVE-2026-30227"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:08:54.326212Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:54.326212Z","products":[{"@id":"pkg:generic/7-zip@26.01"}],"status":"under_investigation","timestamp":"2026-10-13T12:08:54.326212Z","vulnerability":{"name":"CVE-2026-14266"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:08:55.19268Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:55.19268Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:08:55.19268Z","vulnerability":{"name":"CVE-2025-10148"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:08:56.208107Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.208107Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:08:56.208107Z","vulnerability":{"name":"CVE-2025-10966"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:08:56.209529Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.209529Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:08:56.209529Z","vulnerability":{"name":"CVE-2025-4947"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:08:56.21029Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.21029Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:08:56.21029Z","vulnerability":{"name":"CVE-2025-5025"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:08:56.894795Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.894795Z","products":[{"@id":"pkg:generic/7-zip@26.01"}],"status":"under_investigation","timestamp":"2026-10-13T12:08:56.894795Z","vulnerability":{"name":"CVE-2026-58052"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:08:56.895796Z","impact_statement":"The agent does not perform S/MIME message processing or X.509 certificate imports via email libraries","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:08:56.895796Z","products":[{"@id":"pkg:nuget/MimeKit@4.3.0.0"}],"status":"not_affected","timestamp":"2026-10-13T12:08:56.895796Z","vulnerability":{"name":"GHSA-gmc6-fwg3-75m5"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"fixed","timestamp":"2026-10-13T12:08:56.978291Z","vulnerability":{"name":"CVE-2026-48095"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"fixed","timestamp":"2026-10-13T12:08:56.978291Z","vulnerability":{"name":"CVE-2026-48092"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"fixed","timestamp":"2026-10-13T12:08:56.978291Z","vulnerability":{"name":"CVE-2026-48101"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"fixed","timestamp":"2026-10-13T12:08:56.978291Z","vulnerability":{"name":"CVE-2026-48112"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"fixed","timestamp":"2026-10-13T12:08:56.978291Z","vulnerability":{"name":"CVE-2026-48103"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"fixed","timestamp":"2026-10-13T12:08:56.978291Z","vulnerability":{"name":"CVE-2026-48111"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"fixed","timestamp":"2026-10-13T12:08:56.978291Z","vulnerability":{"name":"CVE-2026-48102"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:08:56.978291Z","products":[{"@id":"pkg:generic/7-zip@25.01"}],"status":"fixed","timestamp":"2026-10-13T12:08:56.978291Z","vulnerability":{"name":"CVE-2026-48104"}}],"timestamp":"2026-09-17T12:34:54.202031765Z","tooling":"","version":20}