SQLite vulnerabilities and fixes

CVEs that mention SQLite, ranked by priority. 22 tracked.

SQLite has 22 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 16. Most recent: 2026-10-23. Highest priority: CVE-2026-69085 (score 64/100).

• CVE-2026-69085 CRITICAL 10.0 SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where th
• CVE-2025-34179 HIGH 8.7 NetSupport Manager < 14.12.0001 contains an unauthenticated SQL injection vulnerability in its Connectivity Se
• CVE-2026-53984 CRITICAL 9.1 Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vu
• CVE-2026-69259 HIGH 8.8 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
• CVE-2026-49221 HIGH 8.8 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-49228 HIGH 8.8 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-49224 HIGH 8.3 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-49226 HIGH 8.3 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-49225 HIGH 8.3 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-49223 HIGH 7.6 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-49222 HIGH 7.6 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-49227 HIGH 7.6 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-115478 HIGH 7.1 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults
• CVE-2026-7646 MEDIUM 6.5 UPGRADE IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, includi
• CVE-2026-73331 HIGH 7.1 CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers wi
• CVE-2026-112940 HIGH 7.1 UPGRADE filelock is a platform-independent file lock for Python
• CVE-2026-115883 MEDIUM 6.0 LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and
• CVE-2026-58041 MEDIUM 5.3 A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore
• CVE-2026-47362 MEDIUM 4.6 In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sen
• CVE-2026-53759 LOW 2.0 linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations
• CVE-2026-54619 LOW 2.0 sqlite3 provides Ruby bindings for the SQLite3 embedded database
• CVE-2026-54620 LOW 2.0 sqlite3 provides Ruby bindings for the SQLite3 embedded database

FAQ

How do I fix SQLite vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is SQLite being exploited right now?

None of the tracked SQLite CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which SQLite CVE should I patch first?

CVE-2026-69085 currently ranks highest (64/100): SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where th.

← Back to latest CVEs