[ Vendor · 11 CVEs ]
SQLite
CVEs affecting SQLite published in the last 30 days, plus any SQLite CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-119586 | 30 Oct 2026 | CVSS 7.8 | SQLiteSQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands… | |
| CVE-2026-119591 | 30 Oct 2026 | CVSS 5.5 | SQLiteSQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via… | Fix |
| CVE-2026-119373 | 30 Oct 2026 | CVSS 7.8 | SQLiteSQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging… | Fix |
| CVE-2026-119374 | 30 Oct 2026 | CVSS 7.8 | SQLiteSQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer… | Fix |
| CVE-2026-119375 | 30 Oct 2026 | CVSS 5.5 | SQLiteSQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a… | Fix |
| CVE-2026-119376 | 30 Oct 2026 | CVSS 5.5 | SQLiteSQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE… | Fix |
| CVE-2026-119377 | 30 Oct 2026 | CVSS 3.3 | SQLiteSQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's… | Fix |
| CVE-2026-119378 | 30 Oct 2026 | CVSS 5.5 | SQLiteSQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory… | Fix |
| CVE-2026-119379 | 30 Oct 2026 | CVSS 7.8 | SQLiteSQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers… | Fix |
| CVE-2026-119371 | 30 Oct 2026 | CVSS 5.5 | SQLiteSQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because… | Fix |
| CVE-2026-119372 | 30 Oct 2026 | CVSS 5.5 | SQLiteSQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by… | Fix |