JFrog安全研究人员发现，GitHub上由账户programmervuln/cveadvisory-发布的55个SQLite相关CVE公告中，有54个完全是AI生成的虚假内容[1]。这些虚假公告已被国家漏洞数据库（NVD）和美国网络安全和基础设施安全局（CISA）标记为关键级别[1]。经过AI生成内容检测工具Gptzero测试，所有虚假CVE均被识别为AI生成内容[1]。
研究人员详细分析发现，这些虚假公告存在多个明显的技术缺陷[1]。其中CVE-2026-51302的严重程度从关键级别（10.0分）被降级至高级别（7.6分）[1]。虚假公告中引用的函数exprComputeOperands()在SQLite 3.41版本中根本不存在，直到2025年中期才被添加到代码库中[1]。此外，官方SQLite漏洞公告页面（sqlite.org/cves.html）未列出这些CVE中的任何一个[1]。
这一事件暴露了当前CVE提交和验证流程的系统性问题[1]。美国国家标准与技术研究院（NIST）自2024年2月起暂停了对CVE的深度分析，而现有验证流程缺乏真实身份验证、代码存在性验证以及漏洞复现（PoC）要求[1]。
JFrog security researchers have uncovered a significant integrity failure in the CVE disclosure process, discovering that over 50 SQLite vulnerability advisories published on GitHub are artificially generated content with no basis in reality [1]. The researchers found that 54 out of 55 CVEs issued by the GitHub account programmervuln/cveadvisory- are entirely fabricated, with only one containing an actual vulnerability [1]. All of these fraudulent CVEs tested positive for AI-generated content using Gptzero [1], yet they have already been marked as critical severity by both the National Vulnerability Database (NVD) and the Cybersecurity and Infrastructure Security Agency (CISA) [1].
The investigation revealed systemic failures in vulnerability verification. The referenced function exprComputeOperands() does not exist in SQLite 3.41 and was not added until mid-2025, despite being cited as the source of vulnerabilities [1]. Additionally, none of these CVEs appear on the official SQLite vulnerability disclosure page at sqlite.org/cves.html [1]. CVE-2026-51302 was subsequently downgraded from a critical severity rating of 10.0 to a high rating of 7.6 [1].
The disclosure exposes fundamental weaknesses in how CVEs are validated and published. NIST suspended in-depth analysis of CVE submissions beginning in February 2024, and the current verification process lacks requirements for proof-of-concept code or vulnerability reproduction steps [1]. This absence of authentication verification and mandatory code reproduction has allowed numerous fabricated advisories to enter official vulnerability databases unchecked.