{"@context":"https://openvex.dev/ns/v0.2.0","@id":"pkg:docker/agent@7.84.0","author":"security@datadoghq.com","author_role":"Vulnerability Management","last_updated":"2026-10-13T13:12:20.780087511Z","statements":[{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:46.399863Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:46.399863Z","products":[{"@id":"pkg:generic/krb5@1.21.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:46.399863Z","vulnerability":{"name":"CVE-2007-5894"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:46.399931Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:46.399931Z","products":[{"@id":"pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.11"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:46.399931Z","vulnerability":{"name":"CVE-2026-73500"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:46.399981Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:46.399981Z","products":[{"@id":"pkg:generic/krb5@1.21.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:46.399981Z","vulnerability":{"name":"CVE-2026-40355"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:46.400025Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:46.400025Z","products":[{"@id":"pkg:generic/krb5@1.21.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:46.400025Z","vulnerability":{"name":"CVE-2026-40356"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:46.400121Z","impact_statement":"CVE-2018-10126 represents ZERO security risk to the Datadog Agent running on Ubuntu 24.04. Both Ubuntu and Debian security teams have assessed this as having no security impact, and the vulnerability cannot be reproduced in modern versions of the software.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:13:46.400121Z","products":[{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=libjpeg-turbo"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=libjpeg-turbo"}],"status":"not_affected","timestamp":"2026-10-13T12:13:46.400121Z","vulnerability":{"name":"CVE-2018-10126"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:46.400211Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:46.400211Z","products":[{"@id":"pkg:golang/golang.org/x/net@v0.58.0"},{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:46.400211Z","vulnerability":{"name":"CVE-2026-78663"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:46.400711Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:46.400711Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:46.400711Z","vulnerability":{"name":"CVE-2026-56857"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:46.401002Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:46.401002Z","products":[{"@id":"pkg:golang/golang.org/x/net@v0.58.0"},{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:46.401002Z","vulnerability":{"name":"CVE-2026-78659"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:46.401459Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:46.401459Z","products":[{"@id":"pkg:golang/golang.org/x/net@v0.58.0"},{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:46.401459Z","vulnerability":{"name":"CVE-2026-78669"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:46.401977Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:46.401977Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:46.401977Z","vulnerability":{"name":"CVE-2026-17084"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:46.40203Z","impact_statement":"False positive. The vulnerability only affects Python TLS servers whose sni_callback reassigns SSLSocket.context. The Datadog Agent and its integrations use Python's ssl module only as a TLS client (not as a server); no server-side SSLContext or sni_callback is used. So the vulnerable code is present in the embedded runtime but is never executed, and a remote client cannot trigger it.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:13:46.40203Z","products":[{"@id":"pkg:generic/python@3.13.15"},{"@id":"pkg:docker/agent@\u003cversion\u003e"}],"status":"not_affected","timestamp":"2026-10-13T12:13:46.40203Z","vulnerability":{"name":"CVE-2026-19445"}},{"action_statement":"This vulnerability was fixed in: 7.84.1","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:20:28.841346Z","products":[{"@id":"pkg:golang/golang.org/x/crypto@v0.55.0"}],"status":"affected","timestamp":"2026-10-13T12:13:46.402084Z","vulnerability":{"name":"CVE-2026-56855"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:46.402205Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:46.402205Z","products":[{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:46.402205Z","vulnerability":{"name":"CVE-2026-54873"}},{"action_statement":"This vulnerability was fixed in: 7.84.1","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:20:28.841346Z","products":[{"@id":"pkg:golang/golang.org/x/crypto@v0.55.0"}],"status":"affected","timestamp":"2026-10-13T12:13:46.402259Z","vulnerability":{"name":"CVE-2026-78662"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:46.402475Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:46.402475Z","products":[{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=perl"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=perl"}],"status":"affected","timestamp":"2026-10-13T12:13:46.402475Z","vulnerability":{"name":"CVE-2026-82560"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:46.40258Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:46.40258Z","products":[{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T12:13:46.40258Z","vulnerability":{"name":"CVE-2026-84782"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:46.402622Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:46.402622Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:46.402622Z","vulnerability":{"name":"CVE-2026-94440"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:46.402833Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:46.402833Z","products":[{"@id":"pkg:generic/python@3.13.15"},{"@id":"pkg:docker/agent@\u003cversion\u003e"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:46.402833Z","vulnerability":{"name":"CVE-2026-19553"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.460693Z","impact_statement":"","justification":"component_not_present","last_updated":"2026-10-13T12:13:47.460693Z","products":[{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"}],"status":"not_affected","timestamp":"2026-10-13T12:13:47.460693Z","vulnerability":{"name":"CVE-2026-84784"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.460787Z","impact_statement":"The vulnerability is in the Docker Engine daemon's plugin privilege validation (plugin/manager.go). The image contains no Docker daemon. The Agent binary links only github.com/docker/docker/pkg/system, an indirect Trivy dependency, and none of the plugin or daemon packages. The embedded module is also pinned to moby 28.x commit 31a1689cb0a1, which includes the backported fix 0afb41ce194c, and the module is declared at the patched version v29.3.1.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:13:47.460787Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"not_affected","timestamp":"2026-10-13T12:13:47.460787Z","vulnerability":{"name":"CVE-2026-33997"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.46089Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.46089Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.46089Z","vulnerability":{"name":"CVE-2026-97031"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.461294Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.461294Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.461294Z","vulnerability":{"name":"CVE-2026-15806"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.461348Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.461348Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.461348Z","vulnerability":{"name":"CVE-2026-78667"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.461593Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.461593Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.461593Z","vulnerability":{"name":"CVE-2026-87910"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.461634Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.461634Z","products":[{"@id":"pkg:generic/krb5@1.21.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.461634Z","vulnerability":{"name":"CVE-2007-3149"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.461679Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.461679Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.461679Z","vulnerability":{"name":"CVE-2026-19672"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:27:44.717225Z","products":[{"@id":"pkg:pypi/pip@26.1.1"}],"status":"affected","timestamp":"2026-10-13T12:13:47.46173Z","vulnerability":{"name":"CVE-2026-8643"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.461779Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.461779Z","products":[{"@id":"pkg:pypi/urllib3@2.7.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.461779Z","vulnerability":{"name":"CVE-2026-97689"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.461824Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.461824Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.461824Z","vulnerability":{"name":"CVE-2026-94439"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.462011Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.462011Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.462011Z","vulnerability":{"name":"CVE-2026-56866"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.462269Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.462269Z","products":[{"@id":"pkg:golang/golang.org/x/net@v0.58.0"},{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.462269Z","vulnerability":{"name":"CVE-2026-78660"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.462644Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.462644Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T12:13:47.462644Z","vulnerability":{"name":"CVE-2026-83357"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.462721Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.462721Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.462721Z","vulnerability":{"name":"CVE-2026-101917"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.462761Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.462761Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.462761Z","vulnerability":{"name":"CVE-2026-102274"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.462806Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.462806Z","products":[{"@id":"pkg:golang/github.com/containerd/containerd/v2@v2.2.5"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.462806Z","vulnerability":{"name":"CVE-2026-53493"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.462888Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.462888Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T12:13:47.462888Z","vulnerability":{"name":"CVE-2026-83408"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.462951Z","impact_statement":"The vulnerability is a command injection via newlines in the `poplib` module (Python's POP3 email client library). No agent code uses `poplib`, the agent is an infrastructure monitoring tool with no email/POP3 functionality","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:13:47.462951Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"not_affected","timestamp":"2026-10-13T12:13:47.462951Z","vulnerability":{"name":"CVE-2025-15367"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.46299Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.46299Z","products":[{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.46299Z","vulnerability":{"name":"CVE-2026-72897"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.463032Z","impact_statement":"The ffmpeg-related packages identified in the scan are transitive dependencies introduced through the browser components used by the Synthetics worker. They are not directly invoked by Datadog application code, but are installed as part of the underlying operating system and Chrome dependencies required for browser-based test execution.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:13:47.463032Z","products":[{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"}],"status":"not_affected","timestamp":"2026-10-13T12:13:47.463032Z","vulnerability":{"name":"CVE-2025-1352"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.463096Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.463096Z","products":[{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T12:13:47.463096Z","vulnerability":{"name":"CVE-2026-75806"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.463158Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.463158Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T12:13:47.463158Z","vulnerability":{"name":"CVE-2026-86145"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.463238Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.463238Z","products":[{"@id":"pkg:pypi/pymongo@4.8.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.463238Z","vulnerability":{"name":"CVE-2026-96748"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.463283Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.463283Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.463283Z","vulnerability":{"name":"CVE-2026-101918"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.463317Z","impact_statement":"This is a false positive. The datadog/agent only uses PyJWT to sign outgoing RS256 assertions with a private key (DC/OS authentication, and Azure/MSAL and OAuth client credentials). It never verifies an incoming JWT with HMAC (HS*) allowed, so the bypassable check in HMACAlgorithm.prepare_key never runs (vulnerable code not present). The fix for this vulnerability will be present in v7.84.3 of the agent.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:13:47.463317Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"not_affected","timestamp":"2026-10-13T12:13:47.463317Z","vulnerability":{"name":"CVE-2026-102268"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.463359Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.463359Z","products":[{"@id":"pkg:pypi/urllib3@2.7.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.463359Z","vulnerability":{"name":"CVE-2026-97687"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.463399Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.463399Z","products":[{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.463399Z","vulnerability":{"name":"CVE-2026-75804"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.463446Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.463446Z","products":[{"@id":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=zlib"},{"@id":"pkg:deb/ubuntu/zlib1g@1.3.dfsg-3.1ubuntu2.2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:generic/zlib@1.3.2"},{"@id":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=zlib"},{"@id":"pkg:deb/ubuntu/zlib1g@1.3.dfsg-3.1ubuntu2.2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"}],"status":"affected","timestamp":"2026-10-13T12:13:47.463446Z","vulnerability":{"name":"CVE-2026-85091"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.463524Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.463524Z","products":[{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=libjpeg-turbo"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=libjpeg-turbo"}],"status":"affected","timestamp":"2026-10-13T12:13:47.463524Z","vulnerability":{"name":"CVE-2026-75466"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.463593Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.463593Z","products":[{"@id":"pkg:pypi/urllib3@2.7.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.463593Z","vulnerability":{"name":"CVE-2026-97688"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.463668Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.463668Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T12:13:47.463668Z","vulnerability":{"name":"CVE-2026-8674"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.463855Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.463855Z","products":[{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.463855Z","vulnerability":{"name":"CVE-2026-42772"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.463897Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.463897Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.463897Z","vulnerability":{"name":"CVE-2026-102265"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:27:44.717225Z","products":[{"@id":"pkg:pypi/pip@26.1.1"}],"status":"affected","timestamp":"2026-10-13T12:13:47.463949Z","vulnerability":{"name":"CVE-2026-13346"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.463993Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.463993Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.463993Z","vulnerability":{"name":"CVE-2026-82049"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.464033Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.464033Z","products":[{"@id":"pkg:pypi/pymongo@4.8.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.464033Z","vulnerability":{"name":"CVE-2026-88029"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.464086Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.464086Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T12:13:47.464086Z","vulnerability":{"name":"CVE-2026-89156"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.464182Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.464182Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T12:13:47.464182Z","vulnerability":{"name":"CVE-2026-97399"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.464397Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.464397Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T12:13:47.464397Z","vulnerability":{"name":"CVE-2026-94114"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.464487Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.464487Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T12:13:47.464487Z","vulnerability":{"name":"CVE-2026-89157"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.464556Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.464556Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"affected","timestamp":"2026-10-13T12:13:47.464556Z","vulnerability":{"name":"CVE-2026-103001"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.464614Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.464614Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T12:13:47.464614Z","vulnerability":{"name":"CVE-2026-83368"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.464684Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.464684Z","products":[{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T12:13:47.464684Z","vulnerability":{"name":"CVE-2026-35189"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.464731Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.464731Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.464731Z","vulnerability":{"name":"CVE-2026-102266"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.464769Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.464769Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.464769Z","vulnerability":{"name":"CVE-2026-102272"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.464823Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.464823Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.464823Z","vulnerability":{"name":"CVE-2026-15310"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.46487Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.46487Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.46487Z","vulnerability":{"name":"CVE-2026-102271"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.464946Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.464946Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T12:13:47.464946Z","vulnerability":{"name":"CVE-2026-89160"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.465035Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.465035Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T12:13:47.465035Z","vulnerability":{"name":"CVE-2026-89092"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.465246Z","impact_statement":"While the vulnerable libpam0g package is present in the Datadog Agent's Ubuntu base image, the Agent does not use PAM for authentication operations, making this vulnerability not exploitable in the Agent's context.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:13:47.465246Z","products":[{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.7?arch=all\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.7?arch=all\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pam"}],"status":"not_affected","timestamp":"2026-10-13T12:13:47.465246Z","vulnerability":{"name":"CVE-2024-10041"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.46553Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.46553Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.46553Z","vulnerability":{"name":"CVE-2026-102273"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.465591Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.465591Z","products":[{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.3?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.3?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T12:13:47.465591Z","vulnerability":{"name":"CVE-2016-2781"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.465653Z","impact_statement":"While the vulnerable shadow-utils version is present, the critical exploitation tool (newuidmap) is NOT installed, making the vulnerability unexploitable. Additionally, container architecture eliminates all prerequisite conditions for exploitation.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:13:47.465653Z","products":[{"@id":"pkg:deb/ubuntu/login@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/login@4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/passwd@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/passwd@4.13%2Bdfsg1-4ubuntu3.2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/login@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/login@4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/passwd@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=shadow"},{"@id":"pkg:deb/ubuntu/passwd@4.13%2Bdfsg1-4ubuntu3.2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"}],"status":"not_affected","timestamp":"2026-10-13T12:13:47.465653Z","vulnerability":{"name":"CVE-2024-56433"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.465831Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.465831Z","products":[{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/openjdk-11-jre-headless@11.0.32.1%2B1-1ubuntu1~24.04?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openjdk-lts"}],"status":"affected","timestamp":"2026-10-13T12:13:47.465831Z","vulnerability":{"name":"CVE-2026-105111"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.465889Z","impact_statement":"The vulnerability is in the Docker Engine daemon's AuthZ plugin request forwarding (pkg/authorization/authz.go). The image contains no Docker daemon, and no binary links github.com/docker/docker/pkg/authorization. The Agent links only pkg/system, an indirect Trivy dependency. The embedded module is also pinned to moby 28.x commit 31a1689cb0a1, which includes both backported fixes (6d311e0d8d41 and db7dadaca041). The Agent uses the Docker API only as a client and never runs AuthZ middleware.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:13:47.465889Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"not_affected","timestamp":"2026-10-13T12:13:47.465889Z","vulnerability":{"name":"CVE-2026-34040"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.465946Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.465946Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T12:13:47.465946Z","vulnerability":{"name":"CVE-2026-89158"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.466017Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.466017Z","products":[{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.466017Z","vulnerability":{"name":"CVE-2026-35191"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.466068Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.466068Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.466068Z","vulnerability":{"name":"CVE-2026-102267"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.466285Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.466285Z","products":[{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T12:13:47.466285Z","vulnerability":{"name":"CVE-2026-75805"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.466358Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.466358Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T12:13:47.466358Z","vulnerability":{"name":"CVE-2016-20013"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.466557Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.466557Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T12:13:47.466557Z","vulnerability":{"name":"CVE-2026-76642"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.467651Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.467651Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T12:13:47.467651Z","vulnerability":{"name":"CVE-2026-103111"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.467732Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.467732Z","products":[{"@id":"pkg:pypi/pymongo@4.8.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.467732Z","vulnerability":{"name":"CVE-2026-96749"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.467795Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.467795Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.467795Z","vulnerability":{"name":"CVE-2026-102270"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.467839Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.467839Z","products":[{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.467839Z","vulnerability":{"name":"CVE-2026-54875"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.467892Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.467892Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.467892Z","vulnerability":{"name":"CVE-2026-12345"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.467942Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.467942Z","products":[{"@id":"pkg:golang/github.com/containerd/containerd/v2@v2.2.5"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.467942Z","vulnerability":{"name":"CVE-2026-53495"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.46804Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.46804Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.46804Z","vulnerability":{"name":"CVE-2026-102269"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.468092Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.468092Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T12:13:47.468092Z","vulnerability":{"name":"CVE-2026-78408"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.46921Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.46921Z","products":[{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=elfutils"}],"status":"affected","timestamp":"2026-10-13T12:13:47.46921Z","vulnerability":{"name":"CVE-2025-1376"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.469286Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.469286Z","products":[{"@id":"pkg:golang/golang.org/x/net@v0.58.0"},{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.469286Z","vulnerability":{"name":"CVE-2026-97032"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.469631Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.469631Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.469631Z","vulnerability":{"name":"CVE-2026-94448"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.469838Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.469838Z","products":[{"@id":"pkg:golang/stdlib@1.26.7"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.469838Z","vulnerability":{"name":"CVE-2026-97030"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.470024Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.470024Z","products":[{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T12:13:47.470024Z","vulnerability":{"name":"CVE-2026-54872"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.470084Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.470084Z","products":[{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"}],"status":"affected","timestamp":"2026-10-13T12:13:47.470084Z","vulnerability":{"name":"CVE-2022-3219"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.470173Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.470173Z","products":[{"@id":"pkg:pypi/pyjwt@2.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.470173Z","vulnerability":{"name":"CVE-2026-102275"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.470219Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.470219Z","products":[{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:generic/openssl@3.5.8"},{"@id":"pkg:generic/openssl@3.5.7"},{"@id":"pkg:generic/openssl@3.6.4"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=openssl"},{"@id":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.15?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T12:13:47.470219Z","vulnerability":{"name":"CVE-2026-77696"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.470574Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.470574Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T12:13:47.470574Z","vulnerability":{"name":"CVE-2026-89162"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.470659Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.470659Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T12:13:47.470659Z","vulnerability":{"name":"CVE-2026-78410"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.471784Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.471784Z","products":[{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux%402.39.3-9ubuntu6.6"},{"@id":"pkg:deb/ubuntu/bsdutils@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=util-linux"},{"@id":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T12:13:47.471784Z","vulnerability":{"name":"CVE-2026-78409"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.472923Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.472923Z","products":[{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=acl"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=acl"}],"status":"affected","timestamp":"2026-10-13T12:13:47.472923Z","vulnerability":{"name":"CVE-2026-54369"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.473164Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.473164Z","products":[{"@id":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T12:13:47.473164Z","vulnerability":{"name":"CVE-2026-102474"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.473242Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.473242Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T12:13:47.473242Z","vulnerability":{"name":"CVE-2026-18374"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.473446Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.473446Z","products":[{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T12:13:47.473446Z","vulnerability":{"name":"CVE-2026-18508"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.473643Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.473643Z","products":[{"@id":"pkg:pypi/pymongo@4.8.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.473643Z","vulnerability":{"name":"CVE-2026-96747"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.473701Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.473701Z","products":[{"@id":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T12:13:47.473701Z","vulnerability":{"name":"CVE-2026-102473"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.473764Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.473764Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T12:13:47.473764Z","vulnerability":{"name":"CVE-2026-95818"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.473986Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.473986Z","products":[{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=pcre2"}],"status":"affected","timestamp":"2026-10-13T12:13:47.473986Z","vulnerability":{"name":"CVE-2026-89161"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.474082Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.474082Z","products":[{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=glibc"}],"status":"affected","timestamp":"2026-10-13T12:13:47.474082Z","vulnerability":{"name":"CVE-2026-86805"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.474316Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.474316Z","products":[{"@id":"pkg:golang/github.com/moby/sys/user@v0.4.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.474316Z","vulnerability":{"name":"CVE-2026-61801"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.474392Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.474392Z","products":[{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=acl"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=acl"}],"status":"affected","timestamp":"2026-10-13T12:13:47.474392Z","vulnerability":{"name":"CVE-2026-54370"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.474458Z","impact_statement":"The Datadog Agent ships only libsystemd0, a shared utility library for client-side systemd APIs such as sd_notify. The journald daemon binary is entirely absent from the image.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:13:47.474458Z","products":[{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.17?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.17?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.17?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.17?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.17?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.17?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.17?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.17?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=systemd"}],"status":"not_affected","timestamp":"2026-10-13T12:13:47.474458Z","vulnerability":{"name":"CVE-2026-40228"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.474593Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.474593Z","products":[{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=amd64\u0026distro=ubuntu-24.04"}],"status":"affected","timestamp":"2026-10-13T12:13:47.474593Z","vulnerability":{"name":"CVE-2026-18477"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.474651Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.474651Z","products":[{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=arm64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=amd64\u0026distro=ubuntu-24.04"},{"@id":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=gnupg2"}],"status":"affected","timestamp":"2026-10-13T12:13:47.474651Z","vulnerability":{"name":"CVE-2026-105712"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.47473Z","impact_statement":"While libbpf1 version 1.3.0-2build2 is installed and IS vulnerable, the Datadog Agent does not use libbpf. Additionally, the vulnerability is disputed by maintainers as it requires root privileges to trigger.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:13:47.47473Z","products":[{"@id":"pkg:deb/ubuntu/libbpf1@1.3.0-2build2?arch=arm64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libbpf1@1%3A1.3.0-2build2?arch=arm64\u0026distro=ubuntu-24.04\u0026upstream=libbpf%401.3.0-2build2"},{"@id":"pkg:deb/ubuntu/libbpf1@1.3.0-2build2?arch=amd64\u0026distro=ubuntu-24.04\u0026epoch=1"},{"@id":"pkg:deb/ubuntu/libbpf1@1%3A1.3.0-2build2?arch=amd64\u0026distro=ubuntu-24.04\u0026upstream=libbpf%401.3.0-2build2"}],"status":"not_affected","timestamp":"2026-10-13T12:13:47.47473Z","vulnerability":{"name":"CVE-2025-29481"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.474805Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.474805Z","products":[{"@id":"pkg:pypi/oauthlib@3.3.1"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.474805Z","vulnerability":{"name":"CVE-2026-49264"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.474857Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.474857Z","products":[{"@id":"pkg:pypi/oauthlib@3.3.1"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.474857Z","vulnerability":{"name":"CVE-2026-49265"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.474902Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.474902Z","products":[{"@id":"pkg:cargo/rustls@0.23.43"}],"status":"under_investigation","timestamp":"2026-10-13T12:13:47.474902Z","vulnerability":{"name":"GHSA-2mjx-qc3c-rqvc"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.474946Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.474946Z","products":[{"@id":"pkg:pypi/tuf@4.0.0"}],"status":"affected","timestamp":"2026-10-13T12:13:47.474946Z","vulnerability":{"name":"GHSA-qp9x-wp8f-qgjj"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.47498Z","impact_statement":"The advisory affects only golang.org/x/crypto/openpgp, which is deprecated    and will not be fixed. The Datadog Agent depends on the golang.org/x/crypto module only for    golang.org/x/crypto/nacl/box (via pkg/fleet/daemon). The openpgp package is never imported,    directly or indirectly, so it is not compiled into any Agent binary: a full package-graph check    (go list -deps ./... for linux, windows and darwin) finds no golang.org/x/crypto/openpgp package.    The Agent's PGP/GPG code (comp/metadata/packagesigning/impl/readgpg.go and    pkg/util/kernel/headers/download/rpm/dnfv2/repo/repo.go) already uses the recommended replacement,   github.com/ProtonMail/go-crypto/openpgp. No action is needed.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:13:47.47498Z","products":[{"@id":"pkg:golang/golang.org/x/crypto@v0.55.0"}],"status":"not_affected","timestamp":"2026-10-13T12:13:47.47498Z","vulnerability":{"name":"GO-2026-5932"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:27:44.717225Z","products":[{"@id":"pkg:cargo/faster-hex@0.10.0"}],"status":"affected","timestamp":"2026-10-13T12:13:47.475057Z","vulnerability":{"name":"RUSTSEC-2026-0306"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.475094Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.475094Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"affected","timestamp":"2026-10-13T12:13:47.475094Z","vulnerability":{"name":"GO-2026-5617"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.475166Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.475166Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"affected","timestamp":"2026-10-13T12:13:47.475166Z","vulnerability":{"name":"GO-2026-5668"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.475204Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.475204Z","products":[{"@id":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible"}],"status":"affected","timestamp":"2026-10-13T12:13:47.475204Z","vulnerability":{"name":"GO-2026-5746"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:13:47.475239Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.475239Z","products":[{"@id":"pkg:cargo/unsafe-libyaml@0.2.11"}],"status":"affected","timestamp":"2026-10-13T12:13:47.475239Z","vulnerability":{"name":"RUSTSEC-2024-0449"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.59506Z","products":[{"@id":"pkg:golang/google.golang.org/grpc@v1.83.0"}],"status":"fixed","timestamp":"2026-10-13T12:13:47.59506Z","vulnerability":{"name":"CVE-2026-84445"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.59506Z","products":[{"@id":"pkg:golang/google.golang.org/grpc@v1.83.0"}],"status":"fixed","timestamp":"2026-10-13T12:13:47.59506Z","vulnerability":{"name":"CVE-2026-84304"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.59506Z","products":[{"@id":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0"}],"status":"fixed","timestamp":"2026-10-13T12:13:47.59506Z","vulnerability":{"name":"CVE-2026-81872"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.59506Z","products":[{"@id":"pkg:golang/google.golang.org/grpc@v1.83.0"}],"status":"fixed","timestamp":"2026-10-13T12:13:47.59506Z","vulnerability":{"name":"CVE-2026-84303"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.59506Z","products":[{"@id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.20.0"}],"status":"fixed","timestamp":"2026-10-13T12:13:47.59506Z","vulnerability":{"name":"CVE-2026-81871"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.59506Z","products":[{"@id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.44.0"},{"@id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.44.0"},{"@id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.44.0"},{"@id":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0"}],"status":"fixed","timestamp":"2026-10-13T12:13:47.59506Z","vulnerability":{"name":"CVE-2026-81870"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.59506Z","products":[{"@id":"pkg:golang/github.com/google/cel-go@v0.29.2"}],"status":"fixed","timestamp":"2026-10-13T12:13:47.59506Z","vulnerability":{"name":"GO-2026-6094"}},{"action_statement":"","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:13:47.59506Z","products":[{"@id":"pkg:cargo/h2@0.4.14"}],"status":"fixed","timestamp":"2026-10-13T12:13:47.59506Z","vulnerability":{"name":"RUSTSEC-2026-0258"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.19695Z","impact_statement":"The product is not affected by CVE-2019-16294 as the vulnerable component SciLexer.dll is not present","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:24:56.19695Z","products":[{"@id":"pkg:generic/scintilla@4.4.6"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.19695Z","vulnerability":{"name":"CVE-2019-16294"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.197057Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.197057Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:24:56.197057Z","vulnerability":{"name":"CVE-2025-30761"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.197128Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK base image. no CMP symbols are even linked into the flagged DLLs in the agent. The Agent's own OpenSSL libraries include the fix.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:24:56.197128Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.197128Z","vulnerability":{"name":"CVE-2026-63076"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.197251Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK Nano Server base image. The flagged libcrypto DLL does not contain the vulnerable code. The only MinGit binary that loads libssl (libcurl-openssl-4.dll) never calls any RPK API. The Datadog Agent never runs git or MinGit. The Agent's own OpenSSL libraries are fixed.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:24:56.197251Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.197251Z","vulnerability":{"name":"CVE-2026-18798"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.197323Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK base image. no CMP symbols are even linked into the flagged DLLs in the agent. The Agent's own OpenSSL libraries include the fix.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:24:56.197323Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.197323Z","vulnerability":{"name":"CVE-2026-63073"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.197459Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.197459Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.197459Z","vulnerability":{"name":"CVE-2025-9086"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.197508Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.197508Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.197508Z","vulnerability":{"name":"CVE-2025-5399"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.197546Z","impact_statement":"The agent uses Java for JMXFetch which runs only trusted, administrator-installed code to gather metrics from JMX-enabled applications making the exploitation scenario described in this CVE inapplicable to the agent's use case.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:24:56.197546Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.197546Z","vulnerability":{"name":"CVE-2025-30749"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.19759Z","impact_statement":"CVE-2026-6473 is a PostgreSQL **server-side** integer wraparound vulnerability. The Datadog Agent does not ship or run a PostgreSQL server.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:56.19759Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.19759Z","vulnerability":{"name":"CVE-2026-6473"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.197621Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK Nano Server base image. The flagged libcrypto DLL does not contain the vulnerable code. The only MinGit binary that loads libssl (libcurl-openssl-4.dll) never calls any RPK API. The Datadog Agent never runs git or MinGit. The Agent's own OpenSSL libraries are fixed.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:24:56.197621Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.197621Z","vulnerability":{"name":"CVE-2026-14457"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.19771Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.19771Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.19771Z","vulnerability":{"name":"CVE-2026-3805"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.197741Z","impact_statement":"Oracle's advisory explicitly exempts server-side Java deployments running trusted code and the Datadog Agent JMX fetcher is a server-side process running only the trusted jmxfetch.jar","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:24:56.197741Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.197741Z","vulnerability":{"name":"CVE-2026-21945"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.197789Z","impact_statement":"the vulnerable curl.exe is part of the Microsoft Windows base OS layer. The Datadog Agent never runs it: no Agent code, entrypoint or install script calls curl.exe, and the Agent's HTTP clients are Go net/http, not libcurl. The vulnerability needs curl to open a WebSocket connection to a malicious server, which the product never does. The finding will clear when Microsoft ships a patched ltsc2025 base image.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:24:56.197789Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.197789Z","vulnerability":{"name":"CVE-2026-19931"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.197871Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK base image. The flagged libssl DLL contains no CMS code. No MinGit binary that loads either libcrypto copy (libcurl, the OpenSSL engines and providers, OpenSSH, Heimdal, FIDO2) references any CMS function. The Datadog Agent never runs git or MinGit, and the Agent's own OpenSSL libraries include the fix.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:24:56.197871Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.197871Z","vulnerability":{"name":"CVE-2026-63072"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.197947Z","impact_statement":"CVE-2026-80229 affects only libcurl builds that use the OpenSSL 3+ TLS backend. The libcurl DLL bundled in the confluent-kafka Windows wheel is built with Schannel. It links only Secur32, CRYPT32 and bcrypt and contains no OpenSSL code, provider or library-context APIs, so the vulnerable lib/vtls/openssl.c code is not present. Its only caller, librdkafka, also uses just the libcurl easy interface and never the multi interface that the flaw requires.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:56.197947Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.197947Z","vulnerability":{"name":"CVE-2026-80231"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.198072Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.198072Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:24:56.198072Z","vulnerability":{"name":"CVE-2026-34282"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.198164Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.198164Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.198164Z","vulnerability":{"name":"CVE-2026-11856"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.198225Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.198225Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.198225Z","vulnerability":{"name":"CVE-2025-21587"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.198261Z","impact_statement":"CVE-2026-8924 is a bypass of curl's Public Suffix List (libpsl) cookie-scope check, using trailing-dot host names and cookie domains. The curl project scopes it to PSL-enabled builds, and notes that builds without PSL never perform this protection in the first place. The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 and 8.16.0) is Microsoft's inbox curl tool from the Windows Nano Server base OS layer, built without libpsl: there are 0 'libpsl' or 'psl_' strings, no 'libpsl/%s' component in curl_version() (only 'zlib/%s'), and no PSL library import. The 'PSL' token in the binary is curl's static feature-name table. The PSL check code containing the flaw is therefore not present. The Datadog Agent also never runs curl.exe.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:56.198261Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.198261Z","vulnerability":{"name":"CVE-2026-8924"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.198294Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK base image. the Datadog Agent's own code contains no QUIC implementation of any kind. The only MinGit consumer of libssl (libcurl-openssl-4.dll) references only TLS_client_method and TLS_method, and the Agent never runs git or MinGit. The Agent's own OpenSSL libraries include the fix","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:24:56.198294Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.198294Z","vulnerability":{"name":"CVE-2026-63075"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.198463Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.198463Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.198463Z","vulnerability":{"name":"CVE-2026-10536"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.198527Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.198527Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.198527Z","vulnerability":{"name":"CVE-2026-16239"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.198566Z","impact_statement":"CVE-2026-9079 is a libcurl flaw where clearing proxy authentication credentials on a reused handle does not take effect, so later transfers reuse stale proxy credentials. The curl project states: 'This flaw does not affect the curl command line tool.' The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 on 1809/ltsc2022, 8.16.0 on ltsc2025) is Microsoft's inbox curl command-line tool from the Windows Nano Server base OS layer, built with Schannel. The Datadog Agent never runs curl.exe. No application in the image uses it as a library, so the affected libcurl handle-reuse path is never exercised.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:24:56.198566Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.198566Z","vulnerability":{"name":"CVE-2026-9079"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.198605Z","impact_statement":"OpenSSL is used exclusively as a CLI tool (e.g., certificate operations) and is never run as a QUIC server. The Agent does not implement QUIC/HTTP3 in any form, so the vulnerable code path is not present, making it not exploitable.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:56.198605Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.198605Z","vulnerability":{"name":"CVE-2026-14456"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.198705Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.198705Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:24:56.198705Z","vulnerability":{"name":"CVE-2025-50106"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.198765Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.198765Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.198765Z","vulnerability":{"name":"CVE-2026-14669"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.198796Z","impact_statement":"the vulnerable curl.exe is part of the Microsoft Windows base OS layer. The Datadog Agent never runs it: no Agent code, entrypoint or install script calls curl.exe, and the Agent's HTTP clients are Go net/http, not libcurl. The vulnerability needs curl to open a WebSocket connection to a malicious server, which the product never does. The finding will clear when Microsoft ships a patched ltsc2025 base image.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:24:56.198796Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.198796Z","vulnerability":{"name":"CVE-2026-18924"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.198921Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.198921Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:24:56.198921Z","vulnerability":{"name":"CVE-2026-22016"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.198969Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.198969Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:24:56.198969Z","vulnerability":{"name":"CVE-2025-53066"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.199385Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.199385Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.199385Z","vulnerability":{"name":"CVE-2025-21502"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.199469Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.199469Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.199469Z","vulnerability":{"name":"CVE-2026-5773"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.199501Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK Nano Server base image. CVE-2026-54874 affects only DTLS endpoints that buffer future-epoch records during a handshake. No binary in the image uses DTLS. The only MinGit consumer of libssl (libcurl-openssl-4.dll) references only TLS_client_method and TLS_method, and the Agent never runs git or MinGit. The Agent's own OpenSSL libraries include the fix.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:24:56.199501Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.199501Z","vulnerability":{"name":"CVE-2026-54874"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.199798Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.199798Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:24:56.199798Z","vulnerability":{"name":"CVE-2025-50059"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.199832Z","impact_statement":"CVE-2026-8927 is a libcurl flaw in which reusing one easy handle for sequential transfers through different environment-configured proxies leaks a Digest Proxy-Authorization header to the second proxy. The curl project states that it does not affect the curl command-line tool. The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 and 8.16.0) is that command-line tool, Microsoft's inbox build from the Windows Nano Server base OS layer. It is not a libcurl library exposed to applications. No application in the image loads it as a library, and the Datadog Agent never runs curl.exe, so the affected handle-reuse path is never exercised.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:56.199832Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.199832Z","vulnerability":{"name":"CVE-2026-8927"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.199885Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.199885Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.199885Z","vulnerability":{"name":"CVE-2026-15742"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.199926Z","impact_statement":"CVE-2026-6479 is an uncontrolled recursion vulnerability in the PostgreSQL server-side SSL/GSS connection negotiation path. The Datadog Agent bundle the PostgreSQL client wire-protocol library","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:56.199926Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.199926Z","vulnerability":{"name":"CVE-2026-6479"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.200752Z","impact_statement":"CVE-2026-80229 affects only libcurl builds that use the OpenSSL 3+ TLS backend. The libcurl DLL bundled in the confluent-kafka Windows wheel is built with Schannel. It links only Secur32, CRYPT32 and bcrypt and contains no OpenSSL code, provider or library-context APIs, so the vulnerable lib/vtls/openssl.c code is not present. Its only caller, librdkafka, also uses just the libcurl easy interface and never the multi interface that the flaw requires.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:56.200752Z","products":[{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.200752Z","vulnerability":{"name":"CVE-2026-80229"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.200821Z","impact_statement":"CVE-2026-6478 is a covert timing-channel vulnerability in the PostgreSQL server's MD5 password-comparison routine during client authentication. The Datadog agent image does not ship or run a PostgreSQL server","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:56.200821Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.200821Z","vulnerability":{"name":"CVE-2026-6478"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.200878Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.200878Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.200878Z","vulnerability":{"name":"CVE-2026-6253"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.201056Z","impact_statement":"C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 and 8.16.0) is Microsoft's inbox curl tool in the Nano Server base OS layer. It includes the affected .netrc credential lookup (curl 8.11.1 to 8.20.0). The flaw is triggered only when a user runs curl with netrc enabled against a URL that has a username but no password, while .netrc holds another user's credentials for the same host. The Datadog Agent never runs curl.exe, has no code path that passes netrc options to it, and ships no .netrc file, so the vulnerable code is never run by the product.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:56.201056Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.201056Z","vulnerability":{"name":"CVE-2026-8926"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.201309Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.201309Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.201309Z","vulnerability":{"name":"CVE-2025-14819"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.201367Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.201367Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.201367Z","vulnerability":{"name":"CVE-2026-6471"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.201399Z","impact_statement":"Oracle advisory explicitly excludes server deployments; AWT/JavaFX not used; UI:R unsatisfiable","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:24:56.201399Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.201399Z","vulnerability":{"name":"CVE-2026-21932"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.201453Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.201453Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.201453Z","vulnerability":{"name":"CVE-2026-15741"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.201618Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.201618Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.201618Z","vulnerability":{"name":"CVE-2026-14662"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.201649Z","impact_statement":"CVE-2026-9080 is a libcurl use-after-free triggered only when an application calls curl_easy_pause() from inside the multi interface's event-based CURLMOPT_SOCKETFUNCTION callback. The curl project states: 'This flaw does not affect the curl command line tool.' The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 on 1809/ltsc2022, 8.16.0 on ltsc2025) is Microsoft's inbox curl command-line tool from the Windows Nano Server base OS layer, built with Schannel. The Datadog Agent never runs curl.exe. The tool does not install such a callback, and no application in the image uses it as a library, so the vulnerable path is never exercised.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:24:56.201649Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.201649Z","vulnerability":{"name":"CVE-2026-9080"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.201695Z","impact_statement":"A server superuser would need to force the agent to call the non-existent lo_read() code path. However no code path in the agent ever calls PQfn() or any lo_* function.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:24:56.201695Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.201695Z","vulnerability":{"name":"CVE-2026-6477"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.201724Z","impact_statement":"the vulnerable curl.exe is part of the Microsoft Windows base OS layer. The Datadog Agent never runs it: no Agent code, entrypoint or install script calls curl.exe, and the Agent's HTTP clients are Go net/http, not libcurl. The vulnerability needs curl to open a WebSocket connection to a malicious server, which the product never does. The finding will clear when Microsoft ships a patched ltsc2025 base image.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:24:56.201724Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.201724Z","vulnerability":{"name":"CVE-2026-13608"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.201841Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.201841Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.201841Z","vulnerability":{"name":"CVE-2026-14664"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.201893Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.201893Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.201893Z","vulnerability":{"name":"CVE-2026-14670"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.201961Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.201961Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.201961Z","vulnerability":{"name":"CVE-2026-14676"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.202008Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.202008Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.202008Z","vulnerability":{"name":"CVE-2026-47057"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.202081Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.202081Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.202081Z","vulnerability":{"name":"CVE-2025-14524"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.202169Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.202169Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.202169Z","vulnerability":{"name":"CVE-2026-19385"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.202483Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.202483Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.202483Z","vulnerability":{"name":"CVE-2026-14677"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.202538Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.202538Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.202538Z","vulnerability":{"name":"CVE-2026-14680"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.202594Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.202594Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.202594Z","vulnerability":{"name":"CVE-2026-14671"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.202648Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.202648Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.202648Z","vulnerability":{"name":"CVE-2026-16238"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.202695Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.202695Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.202695Z","vulnerability":{"name":"CVE-2025-30698"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.202836Z","impact_statement":"OpenSSL ships inside the MinGit bundle of Microsoft's .NET SDK base image. no CMP symbols are even linked into the flagged DLLs in the agent. The Agent's own OpenSSL libraries include the fix.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:24:56.202836Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.202836Z","vulnerability":{"name":"CVE-2026-63074"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.20315Z","impact_statement":"CVE-2026-9545 (HTTP/3 early data exposed to an impostor server) is specific to curl built with the ngtcp2 + nghttp3 HTTP/3 backend, with TLS early data enabled. The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 on 1809/ltsc2022, 8.16.0 on ltsc2025) is Microsoft's inbox curl command-line tool from the Windows Nano Server base OS layer, built with Schannel. The Datadog Agent never runs curl.exe. It contains no HTTP/3 backend: there are 0 occurrences of ngtcp2, nghttp3, quiche, msh3 or OpenSSL-QUIC and no corresponding version components (the '--http3' and 'HTTP/3' strings are generic tool help and option text). The vulnerable HTTP/3 code is therefore not present.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:56.20315Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.20315Z","vulnerability":{"name":"CVE-2026-9545"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.203188Z","impact_statement":"CVE-2026-82208 exists only in libcurl builds that use the wolfSSL TLS backend, and the curl project states that it does not affect the curl command-line tool. The flagged C:\\\\Windows\\\\System32\\\\curl.exe is Microsoft's inbox curl tool built with the Schannel backend. It contains no wolfSSL code and links only Windows crypto (CRYPT32 and bcrypt). It ships in the Microsoft Nano Server base OS layer, and the Datadog Agent never runs it","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:56.203188Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.203188Z","vulnerability":{"name":"CVE-2026-82208"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.203306Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.203306Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.203306Z","vulnerability":{"name":"CVE-2026-7168"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.961302Z","impact_statement":"CVE-2026-6637 is a stack buffer overflow and SQL injection vulnerability in the PostgreSQL server-side `refint` contrib module, requiring an active PostgreSQL server with `refint` triggers installed to exploit which the Datadog agent does not embed.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:56.961302Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.961302Z","vulnerability":{"name":"CVE-2026-6637"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.961442Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.961442Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.961442Z","vulnerability":{"name":"CVE-2026-12064"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.961516Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.961516Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.961516Z","vulnerability":{"name":"CVE-2026-8932"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.96186Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.96186Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.96186Z","vulnerability":{"name":"CVE-2026-5545"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.961922Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.961922Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:24:56.961922Z","vulnerability":{"name":"CVE-2026-41254"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.961965Z","impact_statement":"CVE-2026-82209 applies only to curl builds with libpsl support enabled. The flagged C:\\\\Windows\\\\System32\\\\curl.exe is Microsoft's inbox curl tool and is built without libpsl: it has no libpsl symbols or strings, no libpsl/%s version component and no PSL library import, so the vulnerable PSL cookie-domain code path is absent. The binary ships in the Microsoft Nano Server base OS layer, and the Datadog Agent never runs it or uses its cookie engine.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:56.961965Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.961965Z","vulnerability":{"name":"CVE-2026-82209"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.962085Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.962085Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:24:56.962085Z","vulnerability":{"name":"CVE-2025-53057"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.962354Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.962354Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.962354Z","vulnerability":{"name":"CVE-2026-18408"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.962412Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.962412Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.962412Z","vulnerability":{"name":"CVE-2026-47058"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.962717Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.962717Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.962717Z","vulnerability":{"name":"CVE-2025-15079"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.96278Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.96278Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.96278Z","vulnerability":{"name":"CVE-2026-6464"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.962817Z","impact_statement":"CVE-2026-80229 affects only libcurl builds that use the OpenSSL 3+ TLS backend. The libcurl DLL bundled in the confluent-kafka Windows wheel is built with Schannel. It links only Secur32, CRYPT32 and bcrypt and contains no OpenSSL code, provider or library-context APIs, so the vulnerable lib/vtls/openssl.c code is not present. Its only caller, librdkafka, also uses just the libcurl easy interface and never the multi interface that the flaw requires.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:56.962817Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.21.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.962817Z","vulnerability":{"name":"CVE-2026-80230"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.963005Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.963005Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.963005Z","vulnerability":{"name":"CVE-2026-3783"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.963072Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.963072Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.963072Z","vulnerability":{"name":"CVE-2026-3784"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.963545Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.963545Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.963545Z","vulnerability":{"name":"CVE-2026-47063"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.963597Z","impact_statement":"The Datadog Agent does not ship or run a PostgreSQL server","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:56.963597Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.963597Z","vulnerability":{"name":"CVE-2026-6475"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.963659Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.963659Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.963659Z","vulnerability":{"name":"CVE-2026-6429"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.963721Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.963721Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.963721Z","vulnerability":{"name":"CVE-2026-6276"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.963791Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.963791Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.963791Z","vulnerability":{"name":"CVE-2026-14668"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.963918Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.963918Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.963918Z","vulnerability":{"name":"CVE-2025-10148"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.963957Z","impact_statement":"CVE-2026-9547 (SSH host key type mismatch accepted) affects only libcurl built with the libssh backend, for SCP/SFTP transfers using CURLOPT_SSH_KEYFUNCTION. The curl project states that libssh2 builds are not affected and that the flaw does not affect the curl command line tool. The flagged C:\\\\Windows\\\\System32\\\\curl.exe (8.13.0 on 1809/ltsc2022, 8.16.0 on ltsc2025) is Microsoft's inbox curl command-line tool from the Windows Nano Server base OS layer, built with Schannel. The Datadog Agent never runs curl.exe. It contains no libssh backend: there are 0 'libssh' strings, 0 ssh_* API references and no 'libssh/%s' component (the single 'libssh2' token is curl's static feature-name table). The vulnerable code is therefore not present, and the binary is the unaffected command-line tool.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:56.963957Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:24:56.963957Z","vulnerability":{"name":"CVE-2026-9547"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:56.964017Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:56.964017Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:56.964017Z","vulnerability":{"name":"CVE-2026-8286"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.778886Z","impact_statement":"","justification":"component_not_present","last_updated":"2026-10-13T12:24:57.778886Z","products":[{"@id":"pkg:generic/sqlite@3.51.1"},{"@id":"pkg:generic/sqlite@3.43.2"}],"status":"not_affected","timestamp":"2026-10-13T12:24:57.778886Z","vulnerability":{"name":"CVE-2026-11822"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.779097Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.779097Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.779097Z","vulnerability":{"name":"CVE-2026-14679"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.779541Z","impact_statement":"The Datadog Agent does not load or run untrusted Java code and is not a sandboxed Java runtime for customer applications. Accordingly, under normal and supported usage, Datadog has identified no viable exploit path for these vulnerabilities","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:24:57.779541Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-10-13T12:24:57.779541Z","vulnerability":{"name":"CVE-2025-30754"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.779661Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.779661Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.779661Z","vulnerability":{"name":"CVE-2026-8458"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.779867Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.779867Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.779867Z","vulnerability":{"name":"CVE-2026-47021"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.77993Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.77993Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.77993Z","vulnerability":{"name":"CVE-2026-6476"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.779962Z","impact_statement":"MinGit bundled in datadog agent \u003e= 7.83.3 (windows/amd64), inherited unmodified from the upstream microsoft base image, ships OpenSSL 3.5.7, which is genuinely inside the vulnerable range for CVE-2026-75803 (fixed in 3.5.8) and not yet remediated upstream by Microsoft. However, the flaw only manifests for callers that invoke the low-level, deprecated one-shot EVP_Cipher() API directly for AES-OCB/ChaCha20-Poly1305 AEAD decryption of an empty ciphertext and trust its return code alone as tag validation. MinGit's only consumers, git.exe and curl.exe, perform TLS exclusively through OpenSSL's standard high-level record-layer/EVP_DecryptUpdate+Final path and never call EVP_Cipher() for AEAD operations, and neither implements any custom AEAD message-forgery-checking logic of its own. The vulnerable code path is therefore never reached in this deployment, regardless of the outstanding version gap.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:57.779962Z","products":[{"@id":"pkg:generic/openssl@3.5.7"}],"status":"not_affected","timestamp":"2026-10-13T12:24:57.779962Z","vulnerability":{"name":"CVE-2026-75803"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.780229Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.780229Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.780229Z","vulnerability":{"name":"CVE-2026-46917"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.780281Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.780281Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.780281Z","vulnerability":{"name":"CVE-2026-47027"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.780328Z","impact_statement":"This vulnerability detection is a false positive caused by overly broad CPE matching in vulnerability databases. The CVE does not apply to the Windows Datadog Agent.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:57.780328Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:24:57.780328Z","vulnerability":{"name":"CVE-2017-8806"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.780881Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.780881Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.780881Z","vulnerability":{"name":"CVE-2025-10966"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.780946Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.780946Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.780946Z","vulnerability":{"name":"CVE-2026-4873"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.781055Z","impact_statement":"The Datadog Agent does not ship or run a PostgreSQL server","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:57.781055Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:24:57.781055Z","vulnerability":{"name":"CVE-2026-6638"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.781159Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.781159Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.781159Z","vulnerability":{"name":"CVE-2026-61308"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.781516Z","impact_statement":"This vulnerability cannot be exploited in the Datadog Agent container. MinGit is an unused component from the PowerShell base image with proper ACL protections. The container security model eliminates the attack surface required for exploitation.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:24:57.781516Z","products":[{"@id":"pkg:generic/msys2@3.6.10-710e5275eb86d54b45b5f4d71ecc4e1cac1b9302"}],"status":"not_affected","timestamp":"2026-10-13T12:24:57.781516Z","vulnerability":{"name":"CVE-2022-37172"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.781843Z","impact_statement":"The UI:R (user interaction required) prerequisite is structurally unsatisfiable in a containerized agent service, and the attack path described targets sandboxed client deployments","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:24:57.781843Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"not_affected","timestamp":"2026-10-13T12:24:57.781843Z","vulnerability":{"name":"CVE-2026-21933"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.781895Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.781895Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.781895Z","vulnerability":{"name":"CVE-2026-60147"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.781941Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.781941Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.781941Z","vulnerability":{"name":"CVE-2025-4947"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.781987Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.781987Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.781987Z","vulnerability":{"name":"CVE-2026-46968"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.782038Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.782038Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:24:57.782038Z","vulnerability":{"name":"CVE-2026-22021"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.78222Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.78222Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.78222Z","vulnerability":{"name":"CVE-2026-6470"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.782312Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.782312Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.782312Z","vulnerability":{"name":"CVE-2026-1965"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.782614Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.782614Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.782614Z","vulnerability":{"name":"CVE-2025-15224"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.782663Z","impact_statement":"The Datadog Agent contains no PostgreSQL server binaries. The agent bundles only the psycopg Python client library and its libpq dependency on Linux builds; the Windows build contains neither","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:57.782663Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:24:57.782663Z","vulnerability":{"name":"CVE-2026-6474"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.782705Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.782705Z","products":[{"@id":"pkg:generic/curl@8.13.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.782705Z","vulnerability":{"name":"CVE-2025-5025"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.782749Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.782749Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.782749Z","vulnerability":{"name":"CVE-2026-70907"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.782801Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:57.782801Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:57.782801Z","vulnerability":{"name":"CVE-2026-6575"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:57.782877Z","impact_statement":"The vulnerability affects the `mimetypes` module's use of Unix-style paths on Windows. No agent code uses `mimetypes` and no local users exist in the container","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:24:57.782877Z","products":[{"@id":"pkg:generic/python@3.13.15"}],"status":"not_affected","timestamp":"2026-10-13T12:24:57.782877Z","vulnerability":{"name":"CVE-2024-3220"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.712449Z","impact_statement":"","justification":"component_not_present","last_updated":"2026-10-13T12:24:58.712449Z","products":[{"@id":"pkg:generic/sqlite@3.51.1"},{"@id":"pkg:generic/sqlite@3.43.2"}],"status":"not_affected","timestamp":"2026-10-13T12:24:58.712449Z","vulnerability":{"name":"CVE-2026-11824"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.713581Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.713581Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:24:58.713581Z","vulnerability":{"name":"CVE-2026-22013"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.713711Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.713711Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:58.713711Z","vulnerability":{"name":"CVE-2025-13034"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.713783Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.713783Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:58.713783Z","vulnerability":{"name":"CVE-2026-14672"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.713843Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.713843Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:58.713843Z","vulnerability":{"name":"CVE-2026-21925"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.713886Z","impact_statement":"This vulnerability lives entirely in PostgreSQL's DDL privilege-checking code and has no client-library component. The Datadog Agent bundles only `libpq` a client wire-protocol library that contains no DDL authorization logic.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:24:58.713886Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"not_affected","timestamp":"2026-10-13T12:24:58.713886Z","vulnerability":{"name":"CVE-2026-6472"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.71462Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.71462Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:58.71462Z","vulnerability":{"name":"CVE-2026-6469"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.71468Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.71468Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:58.71468Z","vulnerability":{"name":"CVE-2026-47059"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.715468Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.715468Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:58.715468Z","vulnerability":{"name":"CVE-2026-14678"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.71553Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.71553Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:58.71553Z","vulnerability":{"name":"CVE-2026-18024"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.716341Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.716341Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:24:58.716341Z","vulnerability":{"name":"CVE-2026-22018"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.716407Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.716407Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:58.716407Z","vulnerability":{"name":"CVE-2026-60589"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.716713Z","impact_statement":"The Datadog Agent's Go binary uses Go's standard library `compress/zlib` (pure Go, no linkage to system libz), and Python's `zlib` module, while linking against system libz, does not expose `crc32_combine64` to Python userspace.","justification":"vulnerable_code_cannot_be_controlled_by_adversary","last_updated":"2026-10-13T12:24:58.716713Z","products":[{"@id":"pkg:generic/zlib@1.3.1"}],"status":"not_affected","timestamp":"2026-10-13T12:24:58.716713Z","vulnerability":{"name":"CVE-2026-27171"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.716821Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.716821Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:58.716821Z","vulnerability":{"name":"CVE-2026-47010"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.717361Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.717361Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:58.717361Z","vulnerability":{"name":"CVE-2026-14666"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.71742Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.71742Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:24:58.71742Z","vulnerability":{"name":"CVE-2026-23865"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.717482Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.717482Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:58.717482Z","vulnerability":{"name":"CVE-2026-16241"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.717631Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.717631Z","products":[{"@id":"pkg:generic/curl@8.13.0"},{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:58.717631Z","vulnerability":{"name":"CVE-2025-14017"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.717782Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.717782Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:58.717782Z","vulnerability":{"name":"CVE-2026-14673"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.717844Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.717844Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:58.717844Z","vulnerability":{"name":"CVE-2026-14663"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.717894Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.717894Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:24:58.717894Z","vulnerability":{"name":"CVE-2026-34268"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.71795Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.71795Z","products":[{"@id":"pkg:generic/oracle/openjdk@11.0.25%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git"}],"status":"affected","timestamp":"2026-10-13T12:24:58.71795Z","vulnerability":{"name":"CVE-2026-22007"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.718048Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.718048Z","products":[{"@id":"pkg:generic/postgresql@18.3"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:58.718048Z","vulnerability":{"name":"CVE-2026-14681"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:24:58.718452Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:24:58.718452Z","products":[{"@id":"pkg:nuget/NuGet.Packaging@6.14.3-rc.1"},{"@id":"pkg:nuget/NuGet.Protocol@6.14.3-rc.1"}],"status":"under_investigation","timestamp":"2026-10-13T12:24:58.718452Z","vulnerability":{"name":"GHSA-g4vj-cjjj-v7hg"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:30:02.366515Z","products":[{"@id":"pkg:maven/org.bouncycastle/bc-fips@2.0.1"}],"status":"affected","timestamp":"2026-10-13T12:16:34.022209Z","vulnerability":{"name":"CVE-2026-8763"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:30:02.366515Z","products":[{"@id":"pkg:maven/org.bouncycastle/bc-fips@2.0.1"}],"status":"affected","timestamp":"2026-10-13T12:16:34.02242Z","vulnerability":{"name":"CVE-2026-13506"}},{"action_statement":"This vulnerability was fixed in: 7.84.2","action_statement_timestamp":"0001-01-01T00:00:00Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:30:02.366515Z","products":[{"@id":"pkg:maven/org.bouncycastle/bc-fips@2.0.1"}],"status":"affected","timestamp":"2026-10-13T12:16:34.854927Z","vulnerability":{"name":"CVE-2026-13505"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:19:48.041472Z","impact_statement":"The Datadog Agent has no MimeKit dependency and sends no SMTP mail","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:19:48.041472Z","products":[{"@id":"pkg:nuget/MimeKit@4.3.0.0"}],"status":"not_affected","timestamp":"2026-10-13T12:19:48.041472Z","vulnerability":{"name":"CVE-2026-30227"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:19:48.042431Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:19:48.042431Z","products":[{"@id":"pkg:generic/7-zip@26.01"}],"status":"under_investigation","timestamp":"2026-10-13T12:19:48.042431Z","vulnerability":{"name":"CVE-2026-14266"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:19:50.575719Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:19:50.575719Z","products":[{"@id":"pkg:generic/7-zip@26.01"}],"status":"under_investigation","timestamp":"2026-10-13T12:19:50.575719Z","vulnerability":{"name":"CVE-2026-58052"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:19:50.576333Z","impact_statement":"The agent does not perform S/MIME message processing or X.509 certificate imports via email libraries","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:19:50.576333Z","products":[{"@id":"pkg:nuget/MimeKit@4.3.0.0"}],"status":"not_affected","timestamp":"2026-10-13T12:19:50.576333Z","vulnerability":{"name":"GHSA-gmc6-fwg3-75m5"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:18:00.243802Z","impact_statement":"CVE-2025-6965 is a memory corruption vulnerability in SQLite \u003c 3.50.2. The Datadog Windows agent image is not vulnerable: the embedded CPython build is explicitly pinned to SQLite 3.53.0, and the Go SQLite modules (mattn/go-sqlite3, modernc.org/sqlite, glebarez/go-sqlite) are gated behind LINUX_ONLY_TAGS and are never compiled into Windows builds. The only winsqlite3.dll present belongs to the Windows Server 2019 OS base layer which is never loaded by the agent process","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:18:00.243802Z","products":[{"@id":"pkg:generic/sqlite@3.43.2"}],"status":"not_affected","timestamp":"2026-10-13T12:18:00.243802Z","vulnerability":{"name":"CVE-2025-6965"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:18:00.244159Z","impact_statement":"CVE-2026-8925 is a double free in curl's libgsasl-based SASL code (IMAP, POP3 and SMTP) and affects curl 8.15.0 to 8.20.0 only when curl is built with libgsasl. The flagged C:\\\\Windows\\\\System32\\\\curl.exe is Microsoft's inbox curl tool. On 1809 and ltsc2022 it is 8.13.0, which predates the bug. On ltsc2025 it is 8.16.0 but built without libgsasl: there is no libgsasl version component or import, so the vulnerable code is absent. The binary ships in the Microsoft base OS layer, and the Datadog Agent never runs it.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:18:00.244159Z","products":[{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:18:00.244159Z","vulnerability":{"name":"CVE-2026-8925"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:18:00.24599Z","impact_statement":"the vulnerable curl.exe is part of the Microsoft Windows base OS layer. The Datadog Agent never runs it: no Agent code, entrypoint or install script calls curl.exe, and the Agent's HTTP clients are Go net/http, not libcurl. The vulnerability needs curl to open a WebSocket connection to a malicious server, which the product never does. The finding will clear when Microsoft ships a patched ltsc2025 base image.","justification":"vulnerable_code_not_in_execute_path","last_updated":"2026-10-13T12:18:00.24599Z","products":[{"@id":"pkg:generic/curl@8.16.0"}],"status":"not_affected","timestamp":"2026-10-13T12:18:00.24599Z","vulnerability":{"name":"CVE-2026-11586"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:18:00.247799Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:18:00.247799Z","products":[{"@id":"pkg:generic/curl@8.16.0"}],"status":"under_investigation","timestamp":"2026-10-13T12:18:00.247799Z","vulnerability":{"name":"CVE-2026-80255"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:18:01.223697Z","impact_statement":"The Datadog Agent Windows image (\u003e7.82.0) ships three separate SQLite consumers: the embedded Python 3 `sqlite3.dll`, and the Go-based `mattn/go-sqlite3` and `modernc.org/sqlite` libraries used by the Agent binary and none of them are affected: (1) every embedded SQLite version is already ≥3.53.0, well past the fixed version 3.51.1, and (2) the `zipfile` extension is an optional, non-default SQLite component that is not compiled into any of these builds (zero occurrences of `zipfileInflate`/`zipfileModule`/`SQLITE_ENABLE_ZIPFILE` in any binary or source we inspected). This mirrors Debian's own tracker classification of \"unimportant,\" which notes the zipfile extension isn't built into their SQLite packages either.","justification":"vulnerable_code_not_present","last_updated":"2026-10-13T12:18:01.223697Z","products":[{"@id":"pkg:generic/sqlite@3.43.2"}],"status":"not_affected","timestamp":"2026-10-13T12:18:01.223697Z","vulnerability":{"name":"CVE-2025-70873"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:17:54.54481Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:17:54.54481Z","products":[{"@id":"pkg:golang/github.com/aws/aws-sdk-go@v1.55.8"}],"status":"affected","timestamp":"2026-10-13T12:17:54.54481Z","vulnerability":{"name":"GO-2022-0635"}},{"action_statement":"","action_statement_timestamp":"2026-10-13T12:17:54.544844Z","impact_statement":"","justification":"","last_updated":"2026-10-13T12:17:54.544844Z","products":[{"@id":"pkg:golang/github.com/aws/aws-sdk-go@v1.55.8"}],"status":"affected","timestamp":"2026-10-13T12:17:54.544844Z","vulnerability":{"name":"GO-2022-0646"}}],"timestamp":"2026-10-01T13:11:52.39830099Z","tooling":"","version":10}