CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 08:40 UTC)

What this means for you

This week: 5,436 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,436; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product sqlite:sqlite. Show all products

44 CVEs, showing 1 to 44

CVE	Severity	Title	Published
CVE-2019-9936	High 7.5	In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. Assigned by mitre	Mar 22, 2019
CVE-2019-9937	High 7.5	In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. Assigned by mitre	Mar 22, 2019
CVE-2019-5018	High 8.1	An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. Assigned by talos	May 10, 2019
CVE-2019-8457	Critical 9.8	SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables. Assigned by checkpoint	May 30, 2019
CVE-2019-16168	Medium 6.5	In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the… Assigned by mitre	Sep 9, 2019
CVE-2019-19242	Medium 5.9	SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c. Assigned by mitre	Nov 25, 2019
CVE-2019-19244	High 7.5	sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage. Assigned by mitre	Nov 25, 2019
CVE-2019-19317	Critical 9.8	lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other… Assigned by mitre	Dec 5, 2019
CVE-2019-19645	Medium 5.5	alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements. Assigned by mitre	Dec 9, 2019
CVE-2019-19646	Critical 9.8	pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns. Assigned by mitre	Dec 9, 2019
CVE-2019-19603	High 7.5	SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash. Assigned by mitre	Dec 9, 2019
CVE-2019-19880	High 7.5	exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled. Assigned by mitre	Dec 18, 2019
CVE-2019-19926	High 7.5	multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. Assigned by mitre	Dec 23, 2019
CVE-2019-19923	High 7.5	flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. Assigned by mitre	Dec 24, 2019
CVE-2019-19924	Medium 5.3	SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. Assigned by mitre	Dec 24, 2019
CVE-2019-19925	High 7.5	zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive. Assigned by mitre	Dec 24, 2019
CVE-2019-20218	High 7.5	selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error. Assigned by mitre	Jan 2, 2020
CVE-2019-19959	High 7.5	ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by… Assigned by mitre	Jan 3, 2020
CVE-2020-9327	High 7.5	In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations. Assigned by mitre	Feb 21, 2020
CVE-2020-11656	Critical 9.8	In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement. Assigned by mitre	Apr 9, 2020
CVE-2020-11655	High 7.5	SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled. Assigned by mitre	Apr 9, 2020
CVE-2020-13435	Medium 5.5	SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c. Assigned by mitre	May 24, 2020
CVE-2020-13434	Medium 5.5	SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. Assigned by mitre	May 24, 2020
CVE-2020-13632	Medium 5.5	ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. Assigned by mitre	May 27, 2020
CVE-2020-13631	Medium 5.5	SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c. Assigned by mitre	May 27, 2020
CVE-2020-13630	High 7.0	ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. Assigned by mitre	May 27, 2020
CVE-2020-13871	High 7.5	SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late. Assigned by mitre	Jun 6, 2020
CVE-2020-15358	Medium 5.5	In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation. Assigned by mitre	Jun 27, 2020
CVE-2021-20227	Medium 5.5	A flaw was found in SQLite's SELECT query functionality (src/select.c). Assigned by redhat	Mar 23, 2021
CVE-2021-36690	High 7.5	A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. Assigned by mitre	Aug 24, 2021
CVE-2022-35737	High 7.5	SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. Assigned by mitre	Aug 3, 2022
CVE-2020-35527	Critical 9.8	In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause. Assigned by redhat	Sep 1, 2022
CVE-2020-35525	High 7.5	In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing. Assigned by redhat	Sep 1, 2022
CVE-2022-46908	High 7.3	SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions su… Assigned by mitre	Dec 12, 2022
CVE-2021-31239	High 7.5	An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function. Assigned by mitre	May 9, 2023
CVE-2023-7104	Medium 5.5	SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow Assigned by VulDB	Dec 25, 2023
CVE-2024-0232	Medium 4.7	Sqlite: use-after-free bug in jsonparseaddnodearray Assigned by redhat	Jan 16, 2024
CVE-2025-29087	Low 3.2	In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. Assigned by mitre	Apr 7, 2025
CVE-2025-29088	Medium 5.6	In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). Assigned by mitre	Apr 10, 2025
CVE-2025-3277	Medium 6.9	An integer overflow can be triggered in SQLite’s `concat_ws()` function. Assigned by Google	Apr 14, 2025
CVE-2025-6965	High 7.2	Integer Truncation on SQLite Assigned by Google	Jul 15, 2025
CVE-2025-70873	High 7.5	An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file. Assigned by mitre	Mar 12, 2026
CVE-2026-11822	High 7.8	SQLite before 3.53.2 Memory Corruption in FTS5 Extension Assigned by VulnCheck	Jun 9, 2026
CVE-2026-11824	High 7.8	SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate Assigned by VulnCheck	Jun 9, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.