SQ
Vendor
SQLite
67
CVEs
0
On KEV
0
New 30D
Products
SQ9.8
sqlite
SQLite
65 CVEs0 on KEV0 new
SQ9.8
sqldiff
SQLite
1 CVEs0 on KEV0 new
SQ7.3
SQLite3
SQLite
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-11824 | SQ SQLite SQLite | 7.8 | Jun 9 | SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate |
| CVE-2026-11822 | SQ SQLite SQLite | 7.8 | Jun 9 | SQLite before 3.53.2 Memory Corruption in FTS5 Extension |
| CVE-2025-71316 | SQ sqldiff SQLite | 9.8 | Jun 4 | SQLite sqldiff remote code execution via argument injection |
| CVE-2025-70873 | SQ Sqlite Sqlite | 7.5 | Mar 12 | An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a… |
| CVE-2025-7458 | SQ Sqlite Sqlite | 9.1 | Jul 29 | An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to… |
| CVE-2025-6965 | SQ SQLite SQLite | 7.7 | Jul 15 | Integer Truncation on SQLite |
| CVE-2025-3277 | SQ sqlite SQLite | 9.8 | Apr 14 | An integer overflow can be triggered in SQLite’s `concat_ws()` function |
| CVE-2025-29088 | SQ SQLite SQLite | 5.5 | Apr 10 | In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash) |
| CVE-2025-29087 | SQ SQLite SQLite | 7.5 | Apr 7 | In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer |
| CVE-2024-0232 | SQ Sqlite Sqlite | 5.5 | Jan 16 | Sqlite: use-after-free bug in jsonparseaddnodearray |
| CVE-2023-7104 | SQ SQLite3 SQLite | 7.3 | Dec 25 | SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow |
| CVE-2021-31239 | SQ Sqlite Sqlite | 7.5 | May 9 | An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function |
| CVE-2022-46908 | SQ Sqlite Sqlite | 7.3 | Dec 12 | SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead… |
| CVE-2020-35527 | SQ Sqlite Sqlite | 9.8 | Sep 1 | In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause |
| CVE-2020-35525 | SQ Sqlite Sqlite | 7.5 | Sep 1 | In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing |
| CVE-2022-35737 | SQ Sqlite Sqlite | 7.5 | Aug 3 | SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API |
| CVE-2021-45346 | SQ Sqlite Sqlite | 4.3 | Feb 14 | A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a… |
| CVE-2021-36690 | SQ Sqlite Sqlite | 7.5 | Aug 24 | A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query |
| CVE-2021-20227 | SQ Sqlite Sqlite | 5.5 | Mar 23 | A flaw was found in SQLite's SELECT query functionality (src/select.c) |
| CVE-2020-15358 | SQ Sqlite Sqlite | 5.5 | Jun 27 | In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant… |
| CVE-2020-13871 | SQ Sqlite Sqlite | 7.5 | Jun 6 | SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late |
| CVE-2020-13630 | SQ Sqlite Sqlite | 7.0 | May 27 | ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature |
| CVE-2020-13631 | SQ Sqlite Sqlite | 5.5 | May 27 | SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c |
| CVE-2020-13632 | SQ Sqlite Sqlite | 5.5 | May 27 | ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query |
| CVE-2020-13434 | SQ Sqlite Sqlite | 5.5 | May 24 | SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c |
| CVE-2020-13435 | SQ Sqlite Sqlite | 5.5 | May 24 | SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c |
| CVE-2020-11655 | SQ Sqlite Sqlite | 7.5 | Apr 9 | SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is… |
| CVE-2020-11656 | SQ Sqlite Sqlite | 9.8 | Apr 9 | In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement |
| CVE-2020-9327 | SQ Sqlite Sqlite | 7.5 | Feb 21 | In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations |
| CVE-2019-19959 | SQ Sqlite Sqlite | 7.5 | Jan 3 | ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that… |
| CVE-2019-20218 | SQ Sqlite Sqlite | 7.5 | Jan 2 | selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error |
| CVE-2019-19925 | SQ Sqlite Sqlite | 7.5 | Dec 24 | zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive |
| CVE-2019-19924 | SQ Sqlite Sqlite | 5.3 | Dec 24 | SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c |
| CVE-2019-19923 | SQ Sqlite Sqlite | 7.5 | Dec 24 | flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view |
| CVE-2019-19926 | SQ Sqlite Sqlite | 7.5 | Dec 23 | multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls |
| CVE-2019-19880 | SQ Sqlite Sqlite | 7.5 | Dec 18 | exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window… |
| CVE-2019-19603 | SQ Sqlite Sqlite | 7.5 | Dec 9 | SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash |
| CVE-2019-19646 | SQ Sqlite Sqlite | 9.8 | Dec 9 | pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns |
| CVE-2019-19645 | SQ Sqlite Sqlite | 5.5 | Dec 9 | alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements |
| CVE-2019-19317 | SQ Sqlite Sqlite | 9.8 | Dec 5 | lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly… |
| CVE-2019-19244 | SQ Sqlite Sqlite | 7.5 | Nov 25 | sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage |
| CVE-2019-19242 | SQ Sqlite Sqlite | 5.9 | Nov 25 | SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c |
| CVE-2019-16168 | SQ Sqlite Sqlite | 6.5 | Sep 9 | In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe… |
| CVE-2019-8457 | SQ Sqlite Sqlite | 9.8 | May 30 | SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables |
| CVE-2019-5018 | SQ Sqlite Sqlite | 8.1 | May 10 | An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0 |
| CVE-2018-20506 | SQ Sqlite Sqlite | 8.1 | Apr 3 | SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after… |
| CVE-2018-20505 | SQ Sqlite Sqlite | 7.5 | Apr 3 | SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to… |
| CVE-2019-9937 | SQ Sqlite Sqlite | 7.5 | Mar 22 | In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c |
| CVE-2019-9936 | SQ Sqlite Sqlite | 7.5 | Mar 22 | In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information… |
| CVE-2018-20346 | SQ Sqlite Sqlite | 8.1 | Dec 21 | SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3… |
| CVE-2018-8740 | SQ Sqlite Sqlite | 7.5 | Mar 17 | In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c |
| CVE-2017-15286 | SQ Sqlite Sqlite | 7.5 | Oct 12 | SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false and a data… |
| CVE-2017-13685 | SQ Sqlite Sqlite | 5.5 | Aug 29 | The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and application crash) via a crafted file |
| CVE-2017-10989 | SQ Sqlite Sqlite | 9.8 | Jul 7 | The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a… |
| CVE-2016-6153 | SQ Sqlite Sqlite | 5.9 | Sep 26 | os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of… |
| CVE-2015-6607 | SQ Sqlite Sqlite | – | Oct 6 | SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586 |
| CVE-2015-5895 | SQ Sqlite Sqlite | – | Sep 18 | Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors |
| CVE-2013-7443 | SQ Sqlite Sqlite | – | Aug 12 | Buffer overflow in the skip-scan optimization in SQLite 3.8.2 allows remote attackers to cause a denial of service (crash) via crafted SQL statements |
| CVE-2015-3717 | SQ Sqlite Sqlite | – | Jul 3 | Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause… |
| CVE-2015-3416 | SQ Sqlite Sqlite | – | Apr 24 | The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows… |