These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-50277 debrief: A remote unauthenticated attacker can cause denial of service via unbounded CPU and memory consumption by sending a header with many comma-separated key-value pairs or one large value to internet-facing services using dd-trace-cpp library versions before 2.1.0. This issue allows for potential service disruption and resource exhaustion. Defenders should assess exposure and prioritiz [truncated]
CVE-2026-50275 is a high-severity vulnerability in the Datadog PHP Tracer, a tool that provides application performance monitoring and distributed tracing for PHP. The vulnerability allows remote unauthenticated clients to cause unbounded CPU and memory consumption by sending large or oversized W3C baggage HTTP headers. This issue arises because the ddtrace_deserialize_baggage function in ext/distributed_ [truncated]
CVE-2026-50276 is a high-severity vulnerability in the dd-trace-rb library, which is Datadog's client library for Ruby. The vulnerability allows for denial of service (DoS) attacks due to unbounded CPU and memory consumption when parsing a specially crafted HTTP header. This can occur because the library does not properly enforce limits on W3C baggage headers. An attacker can send a crafted HTTP header th [truncated]
The Datadog Android application, prior to version v545-5.9.2, tags Crashlytics data with the user's Datadog UUID without providing a user-facing opt-out. This results in the user's UUID and crash data being visible within Firebase Crashlytics. Organizations should review and update their installations to prevent potential user data exposure. The CVE record was published on 2026-08-07T18:17:17.217Z and has [truncated]
The Datadog Android application, prior to version v541-5.9.2, contains an exported launcher activity AppActivity that accepts an attacker-supplied session, including OAuth tokens, from Intent extras without proper permission guard. This allows a co-installed malicious application to switch the victim's Datadog app to a session controlled by the attacker, resulting in an account-confusion issue. The vulner [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-07T18:17:15.887Z and has not been modified since then. The Datadog Android application prior to v554-5.9.4 stores sensitive content in plaintext within two Room-backed SQLite databases: LocalNotificationDatabase and SearchRecentDatabase. LocalNotificationDatabase contains notification titles, messag [truncated]
A co-installed application can silently dismiss the victim's Bits AI chat notification in Datadog Android application versions prior to v541-5.9.2. This vulnerability stems from the BubbleChatActivity being exported with no permission guard and accepting a SEND intent with a caller-supplied conversation_id. When the activity closes and no in-process session matches that ID, it unconditionally cancels noti [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-07T18:17:14.690Z and has not been modified since then. CVE-2026-44965 is a vulnerability in the Datadog Android application prior to v545-5.9.2. The issue arises from six App Widget configuration activities being exported with no permission guard. A co-installed malicious application can brute-force [truncated]
CVE-2026-50274 is a denial of service vulnerability in Datadog's dd-trace-go library prior to version 2.8.1, used for application performance monitoring, profiling, and security monitoring. The vulnerability allows a remote, unauthenticated attacker to cause unbounded CPU and memory consumption by sending a request with a large number of comma-separated key-value pairs or a single very large value in the [truncated]
CVE-2026-50272 is a high-severity vulnerability in the Datadog APM client for Node.js, allowing for a remote denial of service via unbounded CPU and memory consumption. The issue was fixed in version 5.100.0. This vulnerability affects users of Datadog APM client for Node.js, especially those with baggage propagation enabled. The vulnerability allows a remote, unauthenticated attacker to send a request wi [truncated]
CVE-2026-50271 is a denial of service vulnerability in Datadog's dd-trace-py, a Python APM client. The issue allows for remote, unauthenticated attackers to cause unbounded CPU and memory consumption via specially crafted baggage HTTP headers. This vulnerability has a high impact on users of Datadog's dd-trace-py, especially those with exposure to untrusted HTTP traffic. Successful exploitation enables a [truncated]
CVE-2026-50273 is a vulnerability in Datadog .NET Tracer that allows remote unauthenticated attackers to cause unbounded CPU and memory consumption. The issue is fixed in version 3.43.0. The vulnerability affects Datadog .NET Tracer prior to version 3.43.0 and has a high CVSS score of 7.5. The vulnerability is related to the parsing of incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_I [truncated]
GuardDog, a CLI tool for identifying malicious PyPI packages, contains an output sanitization flaw in versions 2.6.0 through 2.9.0. The tool includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. This allows a malicious package to inject ANSI or OSC escape sequences into analyst terminals or CI [truncated]
GuardDog, a CLI tool for identifying malicious PyPI packages, contains a critical vulnerability in its programmatic remote project scanning functionality from versions 1.0.0 to 2.9.0. The flaw stems from improper handling of attacker-controlled repository URLs through blind string replacement, combined with the transmission of the caller's GitHub credentials alongside the modified request. This enables Se [truncated]