Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,293All CVEsplus 19,140 rejected
- 449Last 24 hours2,722 in the last 7 days
- 16,914Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 15 | 7 | 0 | 0 | 23 | 29 |
| 2025 | 0 | 1 | 0 | 0 | 0 | 1 | 6 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 5 |
| 2023 | 0 | 1 | 0 | 0 | 0 | 1 | 4 |
| 2022 | 0 | 0 | 2 | 0 | 0 | 2 | 3 |
| 2021 | 0 | 0 | 0 | 1 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-116693 | dd-trace: ReDOS in URL query string obfuscationDataDog · dd-trace-js | High8.7 |
| CVE-2026-116589 | Datadog dd-trace-py: IAST instrumentation can lead to application DOSDataDog · dd-trace-py | High8.2 |
| CVE-2026-116588 | Datadog dd-trace-py: ReDOS in URL query string obfuscationDataDog · dd-trace-py | High8.7 |
| CVE-2026-50277 | dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoSDataDog · dd-trace-cpp | High7.5 |
| CVE-2026-50275 | Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoSDataDog · dd-trace-php | High7.5 |
| CVE-2026-50276 | dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoSDataDog · dd-trace-rb | High7.5 |
| CVE-2026-50270 | dd-trace-java: Improper parsing of W3C baggage headers may lead to DoSDataDog · dd-trace-java | High7.5 |
| CVE-2026-54788 | dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoSDataDog · dd-trace-rs | High7.5 |
| CVE-2026-44965 | In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity,…Datadog · Android App | Medium5.5 |
| CVE-2026-44964 | In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed…Datadog · Android App | Medium6.5 |
| CVE-2026-47364 | In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out.…Datadog · Android App | Medium6.5 |
| CVE-2026-47363 | In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including…Datadog · Android App | Medium6.3 |
| CVE-2026-47361 | In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a…Datadog · Android App | Medium6.4 |
| CVE-2026-47362 | In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext:…Datadog · Android App | Medium4.6 |
| CVE-2026-50271 | dd-trace-py: Improper parsing of W3C baggage headers may lead to DoSDataDog · dd-trace-py | High7.5 |
| CVE-2026-50274 | dd-trace-go: Improper parsing of W3C baggage headers may lead to DoSDataDog · dd-trace-go | High7.5 |
| CVE-2026-50272 | dd-trace: Improper parsing of W3C baggage headers may lead to DoSDataDog · dd-trace-js | High7.5 |
| CVE-2026-50273 | Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoSDataDog · dd-trace-dotnet | High7.5 |
| CVE-2026-44971 | GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltrationDataDog · guarddog | High8.2 |
| CVE-2026-44972 | GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package contentDataDog · guarddog | Medium5.0 |
| CVE-2026-33728 | dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code executionDataDog · dd-trace-java | Critical9.3 |
| CVE-2026-22871 | GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCEDataDog · guarddog | High8.7 |
| CVE-2026-22870 | GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoSDataDog · guarddog | High7.1 |
| CVE-2025-61667 | Datadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissionsDataDog · datadog-agent | High7.0 |
| CVE-2024-38525 | dd-trace-cpp malformed unicode header values may cause crashDataDog · dd-trace-cpp | High7.5 |
| CVE-2023-38704 | import-in-the-middle allows unsanitized user controlled input in module generationDataDog · import-in-the-middle | High8.1 |
| CVE-2022-23531 | Arbitrary file write when scanning a specially-crafted local PyPI packageDataDog · guarddog | Medium5.8 |
| CVE-2022-23530 | GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI packageDataDog · guarddog | Medium5.8 |
| CVE-2021-21331 | DataDog API Client contains a Local Information Disclosure VulnerabilityDataDog · datadog-api-client-java | Low3.0 |