nostr-sdk-sqlite (>=0.19.0, <=0.21.0) potentially affected by unknown CVE via nostr (>=0.19.5, <=0.21.0)

nostr CARGO version =0.19.5, =0.19.0, =0.21.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0216...

PT-2026-64981

Name of the Vulnerable Software and Affected Versions sqlite version 3.41 Description A use-after-free issue exists in the JSON parsing logic. This occurs when a remote adversary provides a specially crafted JSON payload that triggers a memory free followed by illegal memory access. This conditio...

PT-2026-64980

Name of the Vulnerable Software and Affected Versions SQLite version 3.41 Description A use-after-free flaw exists in the jsonRemoveFunc function of the SQLite JSON module. The issue occurs because a parsed JSON object is freed, but the system subsequently attempts to call jsonLookupStep using th...

EulerOS Virtualization 2.12.0 : sqlite (EulerOS-SA-2026-2806)

According to the versions of the sqlite package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attacke...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2760)

According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to...

EulerOS Virtualization 2.10.1 : sqlite (EulerOS-SA-2026-2839)

According to the versions of the sqlite package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attacke...

EulerOS Virtualization 2.10.0 : sqlite (EulerOS-SA-2026-2870)

According to the versions of the sqlite package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attacke...

CVE-2026-47133

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store /Library/Application Support/clearancekit/store.db is verified using an ECDSA signature stored in the datasignatures table. T...

MGASA-2026-0278 Updated sqlite3 packages fix security vulnerabilities

The updated packages fix security vulnerabilities: SQLite before 3.53.2 Memory Corruption in FTS5 Extension. CVE-2026-11822 SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate. CVE-2026-11824...

USN-8565-1: SQLite vulnerabilities

It was discovered that SQLite did not properly handle NULL pointer dereferences in the Session Extension when applying a corrupt changeset. An attacker could possibly use this issue to cause SQLite to crash, resulting in a denial of service. CVE-2026-50812 It was discovered that SQLite had a buff...

CVE-2026-47133: Authentication Bypass by Capture-replay

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store /Library/Application Support/clearancekit/store.db is verified using an ECDSA signature stored in the datasignatures table. T...

ROS-20260720-73-0025

The vulnerability of the SQLite component in Google Chrome web browsers relates to the execution of operations beyond the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through a specially created HTML page...

XML External Entity (XXE) Injection

Overview net.sf.mpxj:mpxj is a Library that provides facilities to allow project information to be manipulated in Java and .Net. Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS...

XML External Entity (XXE) Injection

Overview mpxj is a Python wrapper for the MPXJ Java library for manipulating project files Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. ...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the ToolsInvokeHandler.ServeHTTP process. An attacker can gain unauthorized access to the Invoke Endpoint by sending crafted requests remotely. Remediation There is no fixed version for...

GO-2026-5990 Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery

Anyquery: Local File Read LFR via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery...

GO-2026-5988 Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery

Anyquery: Server-Side Request Forgery SSRF via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery...

GO-2026-5958 SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon in github.com/siyuan-note/siyuan/kernel

SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon in github.com/siyuan-note/siyuan/kernel...