3 actively exploited and 16 urgent items are open, out of 812 open in total.
Last scan started 2026-11-05 05:24:30 UTC, finished OK.
| Vulnerability | Affects | Severity | Exploitation | Fix | Status | |
|---|---|---|---|---|---|---|
| CVE-2024-1597 org.postgresql:postgresql vulnerable to SQL Injection via line comment generation |
PostgreSQL JDBC 42.7.* Test dependency |
Critical 10.0 |
5% chance of exploit in the next 30 days |
42.7.2 | New | |
| CVE-2025-3277 An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution. |
SQLite 3.46.* Test dependency |
Critical 9.8 |
1% chance of exploit in the next 30 days |
3.49.1 | New | |
| CVE-2022-31631 In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities. |
SQLite 3.46.* Test dependency |
Critical 9.1 |
2% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2026-43910 java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor |
Appium Java client 9.* Test dependency |
High 8.2 |
0% chance of exploit in the next 30 days |
10.1.1 | New | |
| CVE-2026-54512 jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation |
Jackson Databind 2.17.* Test dependency |
High 8.1 |
1% chance of exploit in the next 30 days |
2.18.8, 2.21.4, 3.1.4 | New | |
| CVE-2026-54513 jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) |
Jackson Databind 2.17.* Test dependency |
High 8.1 |
1% chance of exploit in the next 30 days |
2.18.8, 2.21.4, 3.1.4 | New | |
| CVE-2026-11824 SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in |
SQLite 3.46.* Test dependency |
High 7.8 |
0% chance of exploit in the next 30 days |
3.53.2 | New | |
| CVE-2026-119373 SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process. |
SQLite 3.46.* Test dependency |
High 7.8 |
0% chance of exploit in the next 30 days |
3.54.0 | New | |
| CVE-2026-119374 SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application. |
SQLite 3.46.* Test dependency |
High 7.8 |
0% chance of exploit in the next 30 days |
3.54.0 | New | |
| CVE-2026-119379 SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation. |
SQLite 3.46.* Test dependency |
High 7.8 |
0% chance of exploit in the next 30 days |
3.54.0 | New | |
| CVE-2026-119586 SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3. |
SQLite 3.46.* Test dependency |
High 7.8 |
2% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2022-25647 Deserialization of Untrusted Data in Gson |
Gson 2.8.5 Test dependency |
High 7.7 |
12% chance of exploit in the next 30 days |
2.8.9 | New | |
| CVE-2025-6965 There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above. |
SQLite 3.46.* Test dependency |
High 7.7 |
73% chance of exploit in the next 30 days |
3.50.2 | New | |
| CVE-2026-91777 jackson-databind quadratic forward-reference completion |
Jackson Databind 2.17.* Test dependency |
High 7.5 |
0% chance of exploit in the next 30 days |
2.18.11, 2.21.7, 2.22.3 | New | |
| CVE-2026-68497 jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS |
Jackson Databind 2.17.* Test dependency |
High 7.5 |
1% chance of exploit in the next 30 days |
2.18.10, 2.21.6, 2.22.2 | New | |
| CVE-2026-91776 jackson-databind retains every unknown raw type ID |
Jackson Databind 2.17.* Test dependency |
High 7.5 |
0% chance of exploit in the next 30 days |
2.18.11, 2.21.7, 2.22.3 | New | |
| CVE-2026-42198 pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS |
PostgreSQL JDBC 42.7.* Test dependency |
High 7.5 |
3% chance of exploit in the next 30 days |
42.7.11 | New | |
| CVE-2025-29087 In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory. |
SQLite 3.46.* Test dependency |
High 7.5 |
1% chance of exploit in the next 30 days |
3.49.1 | New | |
| CVE-2025-70873 An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file. |
SQLite 3.46.* Test dependency |
High 7.5 |
0% chance of exploit in the next 30 days |
3.51.1 | New |