AI-Generated Fake CVEs Mislead SQLite Security Reports

Six CVEs related to SQLite, published on July 27, 2026, were retracted just four days later after being found to be fabricated. The vulnerabilities, which included claims of use-after-free conditions, were assigned CVSS scores between 7.5 and 9.8 by CISA. JFrog tested the affected SQLite versions and found that none of the reported vulnerabilities were reproducible, leading to MITRE rejecting the CVEs on July 31. This incident highlights vulnerabilities in the CVE pipeline, particularly the ease with which AI-generated reports can be submitted and accepted. The SQLite developers confirmed that the reported issues were not legitimate bugs. The situation raises concerns about the reliability of automated security tools that rely on CVE databases. The incident serves as a cautionary tale for the cybersecurity community regarding the verification of vulnerability reports.

Key Points: • Six SQLite CVEs published in July 2026 were found to be fabricated and retracted. • CISA initially assigned high CVSS scores to the fake vulnerabilities, misleading security tools. • JFrog's testing revealed no reproducible vulnerabilities, prompting MITRE to reject the CVEs.