CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 10:10 PM ET)

What this means for you

This week: 3,084 CVEs published, 232 critical, and 4 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,084; Show in the list
Critical, last 7 days: 232; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product sqlite:sqlite. Show all products

44 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2019-9936	High 7.5	In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. Assigned by mitre	Mar 22, 2019
CVE-2019-9937	High 7.5	In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. Assigned by mitre	Mar 22, 2019
CVE-2019-5018	High 8.1	An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. Assigned by talos	May 10, 2019
CVE-2019-8457	Critical 9.8	SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables. Assigned by checkpoint	May 30, 2019
CVE-2019-16168	Medium 6.5	In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the… Assigned by mitre	Sep 9, 2019
CVE-2019-19242	Medium 5.9	SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c. Assigned by mitre	Nov 25, 2019
CVE-2019-19244	High 7.5	sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage. Assigned by mitre	Nov 25, 2019
CVE-2019-19317	Critical 9.8	lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other… Assigned by mitre	Dec 5, 2019
CVE-2019-19645	Medium 5.5	alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements. Assigned by mitre	Dec 9, 2019
CVE-2019-19646	Critical 9.8	pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns. Assigned by mitre	Dec 9, 2019

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.