WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product sqlite✕
Overview 18 matches · 1 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
18matches 1in Waratek scope5.6% 0protected0.0% 1exploited5.6% 1CISA KEV5.6% 1public PoC5.6% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 5.6% Outside Waratek scope 2 11.1% Not applicable 15 83.3% Withdrawn CVE 0 0.0%
Critical 18 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 18 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 5.6% Working exploit published 1 5.6% Proof of concept only 1 5.6% Forecast only 0 0.0% No public exploit 15 83.3%
split by peak 8 / year
Not applicable: 15Outside Waratek scope: 2No exploit published: 1 Critical: 18 not blocked: 18 No public exploit: 15Proof of concept only: 1Working exploit published: 1Exploited: 1
20171 Not applicable1 Critical1 not blocked1 No public exploit1 20180 20194 Outside Waratek scope1 Not applicable3 Critical4 not blocked4 Working exploit published1 No public exploit3 20208 Outside Waratek scope1 Not applicable7 Critical8 not blocked8 No public exploit8 20210 20221 Not applicable1 Critical1 not blocked1 No public exploit1 20232 No exploit published1 Not applicable1 Critical2 not blocked2 No public exploit2 20241 Not applicable1 Critical1 not blocked1 Proof of concept only1 20250 20261 Not applicable1 Critical1 not blocked1 Exploited1
2017201820192020202120222023202420252026
18 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-45321 Critical 2026-05-12 Not applicable Exploited On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
CVE-2024-46488 Critical 2024-09-25 Not applicable Proof of concept only sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
CVE-2023-32697 Critical 2023-05-23 No exploit published No public exploit SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.
CVE-2022-43441 Critical 2023-03-16 Not applicable No public exploit A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.
CVE-2020-35527 Critical 2022-09-01 Not applicable No public exploit In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.
CVE-2020-35873 Critical 2020-12-31 Not applicable No public exploit An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because sessions.rs has a use-after-free.
CVE-2020-35872 Critical 2020-12-31 Not applicable No public exploit An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via the repr(Rust) type.
CVE-2020-35870 Critical 2020-12-31 Not applicable No public exploit An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API use-after-free.
CVE-2020-35869 Critical 2020-12-31 Not applicable No public exploit An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings.
CVE-2020-35868 Critical 2020-12-31 Not applicable No public exploit An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via UnlockNotification.
CVE-2020-35867 Critical 2020-12-31 Not applicable No public exploit An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via create_module.
CVE-2020-35866 Critical 2020-12-31 Not applicable No public exploit An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via VTab / VTabCursor.
CVE-2020-11656 Critical 2020-04-09 Outside Waratek scope No public exploit In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
CVE-2019-19646 Critical 2019-12-09 Outside Waratek scope No public exploit pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.
CVE-2019-19317 Critical 2019-12-05 Not applicable No public exploit lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.
CVE-2019-8457 Critical 2019-05-30 Not applicable No public exploit SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.
CVE-2019-9083 Critical 2019-03-21 Not applicable Working exploit published SQLiteManager 1.20 and 1.24 allows SQL injection via the /sqlitemanager/main.php dbsel parameter. NOTE: This product is discontinued.
CVE-2017-10989 Critical 2017-07-07 Not applicable No public exploit The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.