JFrog finds 54 fake SQLite CVEs from one account

JFrog found 54 of 55 SQLite CVE advisories from one GitHub account were fabricated by an LLM, per its research into the repo programmervuln/cveadvisory-.

Six of those 54 were rated Critical, the severity tier that triggers automatic build blocks in most enterprise dependency scanners. CVE databases are the ground truth those scanners trust, and this account polluted it without writing a single real exploit.

Two of the six Critical advisories, CVE-2026-51302 and CVE-2026-51303, carry a CVSS score of 9.8. A third, CVE-2026-51300, scored 9.1.

None of it holds up under a close read, per JFrog. The advisories cite functions absent from the SQLite versions they target.

One points to line 3,575 of a json.c file that only runs 2,706 lines. The patches described as fixes don't appear in SQLite's real commit history, and the attached proof-of-concept exploits don't run.

Nothing here required a real vulnerability. An account with an API key and a few spare hours produced advisories convincing enough to pass, per JFrog. That's all a CVSS-gated scanner checks before it fails a build.