Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : SQLite vulnerability (USN-8775-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8775-1 advisory. It was discovered that SQLite was vulnerable to a buffer overflow in the sqlar extension. If a user were tricked...

CVE-2026-85082 Maple Media Root Browser Classic 3.3.0 - OS command injection through crafted SQLite filenames

Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command...

CVE-2026-85082

The Root Browser Classic 3.3.0 application is vulnerable to an OS command injection due to the improper handling of SQLite database paths. The application passes the file path of a selected database to an operating-system shell without ensuring the filename is safely separated from the command. T...

@bytebase/dbhub's read-only mode does not prevent database writes

Summary Setting readonly = true on the executesql tool does not make the connection read-only. The connectors are written to set PostgreSQL defaulttransactionreadonly=on and open SQLite in readOnly mode, but that code is gated on a config value that is never populated, so it never runs. The only...

EUVD-2026-86326

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting readonly = true on the executesql tool does not make the connection read-only. The connectors are written to set PostgreSQL defaulttransactionreadonly=on and open SQLite in...

CVE-2026-79762 Termix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copy

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

EUVD-2026-86162

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

CVE-2026-51302-PoC

CVE-2026-51302: Technical Inconsistencies sorry for the clickbait repo name but this CVE is complete and utter LLM hallucinated slop, honestly sad to see a CNA accept this with how inconsistent the claims are 💔 Conclusion CVE-2026-51302 is not real 😱 The published SQL does not reproduce a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.71 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.71 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

PT-2026-98316

Name of the Vulnerable Software and Affected Versions Root Browser Classic version 3.3.0 Description Root Browser Classic passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command. This lack of separation can allow for comma...

GHSA-5VVX-3H34-F3GJ MPXJ: XXE Vulnerability in MerlinReader

Impact MPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file...

CVE-2026-61570

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype...

CVE-2026-61570

The MPXJ open-source library (versions 5.5.5 through 16.4.1 ) is vulnerable to an XML External Entity (XXE) injection. The flaw exists in the MerlinReader component when parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database. Because the DocumentBuilder uses default settin...

EUVD-2026-84820

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype...

CVE-2026-61570 MPXJ: XXE Vulnerability in MerlinReader

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype...

PT-2026-97035

Name of the Vulnerable Software and Affected Versions MPXJ versions 5.5.5 through 16.4.0 Description When parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, the software creates a DocumentBuilder with default settings that leave doctype declarations and external...

The vulnerabilities of the sqlar_compress() and sqlar_uncompress() functions in the SQLite database management system’s SQLAR extension allow attackers to cause a service failure.

The vulnerability of the sqlarcompress and sqlaruncompress functions in the SQLite database management system’s SQLAR extension involves executing operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

EulerOS Virtualization 2.10.1 : sqlite (EulerOS-SA-2026-3856)

According to the versions of the sqlite packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to caus...

EulerOS Virtualization 2.10.0 : sqlite (EulerOS-SA-2026-3890)

According to the versions of the sqlite packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to caus...

Vulnerability of the node component `sqlite` in the `vm2` package manager of NPM, allowing attackers to execute arbitrary code.

The vulnerability of the node:sqlite component in the vm2 library of the NPM package manager is related to a data protection mechanism breach. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...