The Impact of AI on CVEs: Industry Challenges

What it is

Part 1 of a JFrog Security Research series (page dated 2026) on how AI-assisted research has changed the CVE ecosystem. It is a vendor post: JFrog sells proprietary severity scores and Xray, and the remediation advice is deferred to Part 2. The data points below are the useful part.

What the page establishes

Maintainer load. Daniel Stenberg ended curl's bug bounty in January 2026, saying fewer than 5% of submissions were confirmed as vulnerabilities. Michael Catanzaro, then GNOME's security coordinator, stopped forwarding reports to maintainers who opted out of AI-generated content. GNOME's disclosure window drops from 90 to 30 days for reports filed on or after 1 August 2026. The page says the Linux kernel already applies immediate full disclosure to reports that look AI-generated.

NVD triage. From 15 April 2026 NIST prioritizes CVEs in CISA's Known Exploited Vulnerabilities catalog, software used by the federal government, and critical software. CVEs published before 1 March 2026 that were backlogged moved to "Not Scheduled". JFrog's view is that many CVEs will get no NVD enrichment, which shifts verification onto enterprise teams.

Severity gap. Since June, libcurl maintainers published 27 CVEs rated Low to Medium. CISA's evaluation raised nearly all to High or Critical. JFrog found client-side crashes and niche-configuration issues scored Critical, and client-side use-after-free bugs scored as network-based memory corruption. The page cites the FIRST CVSS v4.0 User Guide: Base scores measure severity and should not be used alone to assess risk.

Fabricated advisories. In July 2026 JFrog examined a new GitHub account that published 55 advisories, mostly against SQLite and other open source projects. They were scored up to 9.8 Critical, and CISA's ADP agreed. JFrog found 54 of 55 fabricated. The tells were:

• cited functions (exprComputeOperands(), jsonBlobEdit()) that do not exist in the targeted SQLite versions;
• a flaw at line 3555 in a file of 2706 lines;
• a claimed fix whose source diff changed none of the referenced files.

JFrog says the pipeline does not require a working proof of concept before scores are issued, so such reports can reach GHSA, scanners and developer alerts.

Exploit speed. In May 2026 a researcher used Claude to help build a weaponized single-click code-execution exploit for CVE-2026-46529 in GNOME's Evince document viewer and its forks. The page also cites PoCGen and Anthropic research showing similar capability.

Remediation backlog.

• Oracle's July 2026 Critical Patch Update fixed 1,434 CVEs with 1,449 patches across 334 products, and Oracle attributes part of the scale to AI-powered finding.
• depthfirst's agent reported 21 FFmpeg zero-days, several 15 to 20 years old.
• Verizon's 2026 DBIR, as cited by CISA, says organizations fully remediated 26% of KEV vulnerabilities in 2025, down from 38%, with median resolution time at 43 days.
• The UK NCSC warns of a "vulnerability patch wave".

What to do

The page gives no commands. Its implied checks for a suspicious advisory are to confirm the named functions exist in the affected version, confirm line numbers fall within the file, and confirm the claimed fix commit changes the referenced files. It also implies that CVSS Base score and NVD enrichment should not be the only prioritization inputs.

Caveats

The libcurl and SQLite findings are JFrog's own analysis, and the severity-inflation conclusion supports JFrog's product pitch. The "four-month window" for the libcurl CVEs is not dated precisely beyond "since June". Part 2 holds the protection strategies and a libheif exploit chain, which this page does not cover.