Over the past few days a newly created GitHub repo (programmervuln/cveadvisory-) published a batch of SQLite vulnerability advisories, part of 50+ CVEs suspected to be LLM slop. NVD flagged them as critical and CISA’s ADP agreed, but JFrog security researchers found the claims unsupported.

Investigating CVE-2026-51302 showed Red Hat initially gave it a 10.0 Critical score, later downgraded to 7.6 High. Researchers examined the cited code and discovered non‑existent functions, wrong line numbers, and absent patches; PoC payloads did not trigger crashes or memory errors.

Using an isolated workflow—cloning the official sqlite/sqlite repo, building versions 3.41.0, 3.51.2, 3.51.3 in Docker, running PoC SQL under AddressSanitizer—the team confirmed none of the advisories reproduced the claimed bugs. Many advisories referenced functions that only appeared later or cited non‑existent lines.

A broader audit of 55 advisories from the same account revealed 54 were fabricated, with only one containing a real bug wrapped in unverified metadata. The incident highlights missing vendor corroboration, absent commit hashes, and the ease with which fake CVEs slip into NVD, MITRE, GHSA, and enterprise scanners.