Sqlite · product
SQLite
67 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- likely to be exploited
- 6
Every one of the 67 is a mark on the map. Named now: 53 to 67, most at risk first.
- SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead all…
- SQLite integer overflow in key info allocation may lead to information disclosure.
- SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()
- SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()
- SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()
- In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication i…
- SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch
- SQLite before 3.53.2 Out-of-Bounds Read in FTS5 fts5LeafSeek
- SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()
- SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
- SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate
- SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
- SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()
- SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()
- SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.