NIST NVD

The NIST National Vulnerability Database is a comprehensive, government-maintained repository of known software and hardware vulnerabilities with standardized severity ratings and impact assessments. Organizations rely on the NVD to identify security risks in their AI systems, model dependencies, and software supply chains, making it essential for vulnerability management and compliance reporting. For enterprises deploying AI governance frameworks, the NVD provides the baseline data needed to track and remediate security exposures across infrastructure and third-party components.

1 item

ResearchUS2026-08-03

54 Fake CVEs Expose a Systemic Integrity Gap in Enterprise Vulnerability Management

JFrog researchers identified 54 apparently AI-generated, non-reproducible CVEs submitted through an obscure GitHub repository, several of which received high or critical CVSS scores before being flagged as bogus. The incident reveals a structural flaw in the CVE pipeline: no mandatory proof-of-concept verification step exists to catch AI hallucinations before they reach enterprise scanners and downstream databases. With NIST's NVD backlog exceeding 27,000 unprocessed records, the secondary review layer that compliance programs historically relied on has effectively collapsed.

JFrog CVE pipeline vulnerability management software supply chain AI-generated disinformation NIST NVD hallucination security scanning