LLM Slop CVEs: 54 Fake Vulnerabilities Hit NVD — Act Now

JFrog Security Research reported that 54 of 55 CVE advisories published from a new GitHub account were AI-hallucinated, with six targeting SQLite and all six entering the National Vulnerability Database, GitHub Security Advisories, and enterprise scanning tools before detection. The fake advisories included CVSS scores up to 9.8 Critical, and SQLite's official security page labeled them unreproducible AI hallucinations, while Red Hat and MITRE flagged them as false positives or disputed. JFrog researcher Afek Berger noted that generative AI has reduced the effort to produce plausible advisories to near zero, highlighting the vulnerability of the CVE pipeline.

JFrog Security Research dropped a report this week that every developer running automated CVE scanning needs to read. Researchers discovered that 54 of 55 CVE advisories published from a new GitHub account were entirely fabricated — AI-hallucinated vulnerability reports with CVSS scores as high as 9.8 Critical. Six of those targeted SQLite, one of the most widely deployed libraries on the planet. All six made it into the National Vulnerability Database, GitHub Security Advisories, and enterprise scanning tools before anyone caught them. SQLite’s official security page has since added a note about each one: “These are unreproducible. They appear to be AI hallucinations.” Red Hat told customers to treat scanner detections for CVE-2026-51302 as false positives. MITRE quietly flagged the batch as disputed. This is not a drill. This is the first publicly documented case of an AI-generated CVE spam campaign that successfully infiltrated the global vulnerability pipeline — and your scanner almost certainly surfaced at least one of these this week. Why the CVE Pipeline Had No Defense Here is the uncomfortable truth: the CVE system was designed for a world where researchers found bugs by reading code and building exploits by hand. That world is gone. The MITRE submission process has no identity verification for individual reporters and no proof-of-concept requirement. The pipeline operates on the honor system — CNAs trust submitters to have actually verified what they’re claiming. JFrog researcher Afek Berger put it bluntly: “Generative AI has lowered the effort required to produce a plausible-looking advisory to close to zero, while the effort required to verify one remains unchanged.” NIST made things worse by stopping manual CVE enrichment in early 2024 after the backlog hit 17,000 entries. By end of 2025, that backlog had grown to 27,000+. In April 2026, NIST formally announced https://www.nist.gov/news-events/news/2026/04/nist-updates-nvd-operations-address-record-cve-growth it would now only enrich CVEs appearing in the CISA Known Exploited Vulnerabilities catalog, federal software, or critical infrastructure systems — roughly 15–20% of projected volume. The rest enter the NVD with no severity score, no product context, and no human review. That is precisely the category where AI-generated fakes live. CVE volume grew 263% from 2020 to 2025. AI generation makes batch-producing plausible-looking fake advisories near-free. Do the math. The Six Fake SQLite CVEs Here is what the batch actually looked like. All six cleared the submission process and entered downstream databases before JFrog’s analysis https://research.jfrog.com/post/sqlite-critical-cves-or-llm-slops/ caught them: | CVE | CVSS | Claimed Issue | Reality | |---|---|---|---| | CVE-2026-51302 | 9.8 | Use-after-free in expression eval | Function does not exist in any SQLite version | | CVE-2026-51303 | 9.8 | Memory corruption | PoC produced no crash under AddressSanitizer | | CVE-2026-51300 | 9.1 | Buffer overflow | Line numbers cited exceed actual file length | | CVE-2026-51297 | 8.8 | Integer overflow | Referenced wrong code path entirely | | CVE-2026-51296 | 7.5 | NULL dereference | Unreproducible — confirmed AI hallucination | | CVE-2026-51304 | 7.5 | Type confusion | Unreproducible — confirmed AI hallucination | JFrog caught the fakes by checking the code: referenced functions didn’t exist in the cited SQLite versions, line numbers exceeded file lengths, and running the provided proof-of-concept under AddressSanitizer produced valid query results with no memory errors. The fakes were sophisticated enough to fool automated systems but fell apart under five minutes of manual inspection. Check SQLite’s official CVE page https://www.sqlite.org/cves.html for the vendor’s own statement on each entry. The AI Agent Second-Order Problem This gets worse if you’re running AI coding agents with access to your CVE scanner output. When an AI agent encounters a fabricated CVE with a 9.8 CVSS score, it does what agents do: it tries to fix the problem. It will search for the referenced function, not find it, then potentially hallucinate an alternative interpretation and generate code changes for a vulnerability that does not exist. Your engineer then reviews a diff addressing a ghost. This isn’t hypothetical. Enterprise surveys in 2026 report that 88% of organizations experienced a confirmed AI agent security incident in the prior year. Fake CVEs entering automated remediation pipelines are a new attack surface without a playbook yet. How to Protect Your Pipeline Now You cannot wait for MITRE to fix the submission process. Until then, apply these checks before acting on any CVE your scanner surfaces: Check the vendor’s own security page first. SQLite, PostgreSQL, nginx, and most major open-source projects maintain their own CVE lists. If a CVE isn’t there, treat it with extreme skepticism. Demand a reproducible PoC. A plausible description is not proof. If the advisory lacks steps you can actually run, it is not verified. Verify function names against the actual version. Open the source. If the cited function doesn’t exist at the cited line in the cited version, the CVE is likely fabricated. Flag new GitHub accounts publishing advisory batches. Mass advisory output from a brand-new account is a red flag, not a research portfolio. Use the KEV entries are confirmed exploited in the wild. Everything else has room for verification before action. CISA KEV catalog https://www.cisa.gov/known-exploited-vulnerabilities-catalog as your actual priority queue. Check NIST enrichment status. Under the April 2026 policy, most CVEs arrive without NIST-curated severity scores. An unverified claimed CVSS 9.8 from an unverified source is not a CVSS 9.8. The System Needs More Than a Patch The CVE ecosystem was built for manual, good-faith reporting. It has no mechanism to handle AI-generated bulk submissions. The community’s reaction on Hacker News https://news.ycombinator.com/item?id=49154332 was pointed: the system is accepting unauthenticated input and triggering resource exhaustion in security teams across the industry. Expect the CVE program to eventually require cryptographic attestation or verified CNA sponsorship for submissions. Until that happens, your security pipeline needs a human verification layer between “scanner flagged a CVE” and “we act on it” — especially for well-maintained libraries where a fabricated advisory should take five minutes to disprove. The full JFrog investigation is at JFrog Security Research https://research.jfrog.com/post/sqlite-critical-cves-or-llm-slops/ . The raw analysis of how each PoC failed is the most instructive part — worth reading before your next triage meeting.