Back Feeds.4Sysops

MITRE rejects 54 fake SQLite CVEs after AI slop hits the CVE pipeline

Feeds.4Sysops •IT News • August 4, 2026

MITRE has rejected a batch of fabricated CVE records after researchers found that 54 of 55 advisories from a newly created GitHub repository appeared bogus. The incident shows how AI-generated vulnerability reports can enter trusted databases and mislead automated security tools. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AI-Generated Fake CVEs Mislead SQLite Security Reports Six CVEs related to SQLite, published on July 27, 2026, were retracted just four days later after being found to be fabricated. The vulnerabilities, which included claims of use-after-free conditions, were assigned CVSS scores between 7.5 and 9.8 by CISA. JFrog tested the affected SQLite versions and found that none of the reported vulnerabilities were reproducible, leading to MITRE rejecting the CVEs on July 31. This incident highlights vulnerabilities in the CVE pipeline, particularly the ease with which AI-generated reports can be submitted and accepted. The SQLite developers confirmed that the reported issues were not legitimate bugs. The situation raises concerns about the reliability of automated security tools that rely on CVE databases. The incident serves as a cautionary tale for the cybersecurity community regarding the verification of vulnerability reports. 7 sources 36

Extracted Entities

Platforms (1)

SQLite