AI-Generated Fake CVEs Mislead SQLite Vulnerability Reporting

Six vulnerabilities in SQLite, published as CVEs on July 27, 2026, were retracted four days later after being found to be fabricated. JFrog tested the claims and confirmed that none of the vulnerabilities existed in the code, with CVSS scores ranging from 7.5 to 9.8 assigned by CISA. The vulnerabilities were linked to a new GitHub repository that submitted questionable CVEs. JFrog's analysis showed that the reported functions and line numbers were fictitious, leading to MITRE rejecting all six CVEs on July 31. This incident highlights vulnerabilities in the CVE pipeline, exacerbated by NIST's backlog in processing submissions. The findings suggest that AI-generated reports could continue to infiltrate the ecosystem if verification processes are not improved.

Key Points: • Six bogus CVEs for SQLite were published and later retracted after testing. • JFrog confirmed that none of the vulnerabilities existed in the tested SQLite versions. • The incident reveals significant flaws in the CVE reporting and verification process.