The latest articles on DEV Community by Gökhan Köse (@koeseo). https://dev.to/koeseo https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4233987%2Fe50783e4-2ddf-44c7-aee6-9b38aa2b8b2e.png https://dev.to/koeseo en Gökhan Köse Sun, 08 Nov 2026 18:28:16 +0000 https://dev.to/koeseo/52-prompt-injection-cves-in-2026-so-far-what-the-numbers-say-3apj https://dev.to/koeseo/52-prompt-injection-cves-in-2026-so-far-what-the-numbers-say-3apj <p>Most articles about prompt injection quote the same two numbers: OWASP ranks it first in the LLM Top 10, and "most models are vulnerable". Neither tells you how often it actually turns into a registered vulnerability. So we counted.</p> <p>Since January 2026 the National Vulnerability Database lists <strong>52 CVEs</strong> in LLM and agent software where prompt injection is the cause or the consequence (numbers as of 6 November 2026; the full list with NVD links is at <a href="https://promptinjections.de/cve-verzeichnis/" rel="noopener noreferrer">promptinjections.de/cve-verzeichnis</a>).</p> <h2> What the 52 look like </h2> <ul> <li> <strong>Severity:</strong> 6 critical (CVSS 9.0+), 32 high, 13 medium, 1 low. Median base score 8.0.</li> <li> <strong>Timeline:</strong> 1 in January, 2 in May, 3 in July, 10 in August, 13 in September, 23 in October. Part of the autumn jump is method: since September we also query the NVD monthly for "prompt injection", so earlier months are under-counted rather than quieter.</li> <li> <strong>Product types:</strong> coding agents lead with 8, followed by AI gateways/proxies (6) and MCP servers (6). Inference infrastructure has 4, agent frameworks 3, browsers with built-in assistants 3. The other 20 entries are single cases across twenty product types, which says something about how wide the attack surface has become.</li> <li> <strong>Weakness classes:</strong> CWE-918 (server-side request forgery) is the most common with 7, then CWE-436 (interpretation conflict, 5), CWE-502 (deserialization), CWE-862 (missing authorization) and CWE-94 (code injection) with 4 each. Prompt injection rarely stands alone in a CVE; it is the entry point to a classic bug.</li> </ul> <h2> The monthly threat index </h2> <p>Beside CVEs we track incidents, research, standards and vendor actions in a monthly index: 20 entries in August, 37 in September, 52 in October, 109 in total. Across the three issues the area with the most entries is "agent frameworks and tool servers" (28), followed by "defense and architecture" (24) and "coding agents" (15). Every entry links a dated primary source.</p> <h2> Use the data </h2> <p>Everything is CC BY 4.0: JSON and CSV on <a href="https://github.com/koeseo/promptinjections-dataset" rel="noopener noreferrer">GitHub</a>, stable API endpoints (<a href="https://promptinjections.de/api/v1/cves.json" rel="noopener noreferrer">/api/v1/cves.json</a>), a DOI for citing a fixed version (<a href="https://doi.org/10.5281/zenodo.24054569" rel="noopener noreferrer">10.5281/zenodo.24054569</a>), a <a href="https://huggingface.co/datasets/goekhankoese/promptinjections-dataset" rel="noopener noreferrer">Hugging Face mirror</a> and a <a href="https://www.kaggle.com/datasets/goekhankoese/prompt-injection-cves-and-threat-index" rel="noopener noreferrer">Kaggle mirror</a>. The statistics page recomputes all numbers on every build: <a href="https://promptinjections.de/threat-index/zahlen/" rel="noopener noreferrer">promptinjections.de/threat-index/zahlen</a></p> <p>The site itself is in German; the data and the README are not.</p> <p><em>Disclosure: I run promptinjections.de.</em></p> opensource security ai llm