CVE-2026-102265 vulnerabilities

Vulnerabilities for packages: kserve, semgrep, open-webui, datadog-agent, py3-cassandra-medusa, ggshield, superset...

CVE-2026-102273 vulnerabilities

Vulnerabilities for packages: kserve, semgrep, open-webui, datadog-agent, py3-cassandra-medusa, ggshield, superset...

CVE-2026-102274 vulnerabilities

Vulnerabilities for packages: kserve, semgrep, open-webui, datadog-agent, py3-cassandra-medusa, ggshield, superset...

GHSA-8WJV-2P76-3863 vulnerabilities

Vulnerabilities for packages: kserve, semgrep, open-webui, datadog-agent, py3-cassandra-medusa, ggshield, superset...

GHSA-9V7F-9G4P-FFGJ vulnerabilities

Vulnerabilities for packages: kserve, semgrep, open-webui, datadog-agent, py3-cassandra-medusa, ggshield, superset...

GHSA-P4G4-X82P-Q773 vulnerabilities

Vulnerabilities for packages: kserve, semgrep, open-webui, datadog-agent, py3-cassandra-medusa, ggshield, superset...

GHSA-W2CX-738M-MC7W vulnerabilities

Vulnerabilities for packages: kserve, semgrep, open-webui, datadog-agent, py3-cassandra-medusa, ggshield, superset...

CVE-2026-102266 vulnerabilities

Vulnerabilities for packages: kserve, semgrep, open-webui, datadog-agent, py3-cassandra-medusa, ggshield, superset...

CVE-2026-102267 vulnerabilities

Vulnerabilities for packages: kserve, semgrep, open-webui, datadog-agent, py3-cassandra-medusa, ggshield, superset...

CVE-2026-102271 vulnerabilities

Vulnerabilities for packages: kserve, semgrep, open-webui, datadog-agent, py3-cassandra-medusa, ggshield, superset...

HackerOne: HackerOne Code: a live password reset token reaches Datadog RUM, and the same session records the account it unlocks

A password reset token was transmitted to a real user monitoring service before the reset form was submitted. The token was passed as a query string parameter in the URL and recorded by the monitoring SDK without any redaction. The same monitoring session also captured the account identifier afte...

CVE-2026-85999 vulnerabilities

Vulnerabilities for packages: open-webui, airflow, datadog-agent-fips...

CVE-2026-86000 vulnerabilities

Vulnerabilities for packages: open-webui, airflow, datadog-agent-fips...

GHSA-GJV8-XP57-G29C vulnerabilities

Vulnerabilities for packages: open-webui, airflow, datadog-agent-fips...

GHSA-J934-XHV5-FG8F vulnerabilities

Vulnerabilities for packages: open-webui, airflow, datadog-agent-fips...

CVE-2026-50275

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...

CVE-2026-50277

dd-trace-cpp (Datadog's C++ distributed tracing library) prior to 2.1.0 parses incoming W3C baggage headers on the extraction path without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits, even though those limits are applied during injection. A remote unauthenticated att...

CVE-2026-50275 Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...

CVE-2026-50275 Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...

EUVD-2026-82416

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...