We used to allow anonymous users to enter new bug reports directly into our bug tracking system. However, our experience with this procedure was unsatisfactory. Most of the bug reports we received were of low quality. Many problems turned out to be problems in the application or in the programmer's mental model of how SQLite works. Other "bug reports" were thinly veiled support requests. Still other reports are so poorly written that we could not figure out what the problem was. There were also numerous duplicates.
Ideally, our bug database should be usable as an historical reference to track real problems with SQLite and to facilitate studies of bug density and software quality. But the high volume of "noise" reports inhibits that goal.
In effort to reduce the level of background noise, we now ask users to report bugs to the SQLite Forum.
The idea is that bug reports can be filtered on the forum and those that are actual new bugs can be transferred into our bug tracking system by registered developers.
Information about CVEs against SQLite is available on the Vulnerabilities page of the documentation, and especially in the CVE Table at the bottom of that report. If you know of new CVEs against SQLite that are not described in the report, please bring them to the attention of the developers by reporting them on the SQLite Forum.