Let's not advertise then that GeoPackage is built on top of SQLite.
In defense of SQLite, it isn't any more prone to issues than most software, and the group behind SQLite does address vulnerabilities fairly quickly. If having CVE entries was sufficient to block software from the network, I am not sure how many applications would remain on the network.