52 prompt-injection CVEs in 2026 so far: what the numbers say
Most articles about prompt injection quote the same two numbers: OWASP ranks it first in the LLM Top 10, and "most models are vulnerable". Neither tells you how often it actually turns into a registered vulnerability. So
Most articles about prompt injection quote the same two numbers: OWASP ranks it first in the LLM Top 10, and "most models are vulnerable". Neither tells you how often it actually turns into a registered vulnerability. So we counted.
Since January 2026 the National Vulnerability Database lists 52 CVEs in LLM and agent software where prompt injection is the cause or the consequence (numbers as of 6 November 2026; the full list with NVD links is at promptinjections.de/cve-verzeichnis).
What the 52 look like
- Severity: 6 critical (CVSS 9.0+), 32 high, 13 medium, 1 low. Median base score 8.0.
- Timeline: 1 in January, 2 in May, 3 in July, 10 in August, 13 in September, 23 in October. Part of the autumn jump is method: since September we also query the NVD monthly for "prompt injection", so earlier months are under-counted rather than quieter.
- Product types: coding agents lead with 8, followed by AI gateways/proxies (6) and MCP servers (6). Inference infrastructure has 4, agent frameworks 3, browsers with built-in assistants 3. The other 20 entries are single cases across twenty product types, which says something about how wide the attack surface has become.
- Weakness classes: CWE-918 (server-side request forgery) is the most common with 7, then CWE-436 (interpretation conflict, 5), CWE-502 (deserialization), CWE-862 (missing authorization) and CWE-94 (code injection) with 4 each. Prompt injection rarely stands alone in a CVE; it is the entry point to a classic bug.
The monthly threat index
Beside CVEs we track incidents, research, standards and vendor actions in a monthly index: 20 entries in August, 37 in September, 52 in October, 109 in total. Across the three issues the area with the most entries is "agent frameworks and tool servers" (28), followed by "defense and architecture" (24) and "coding agents" (15). Every entry links a dated primary source.
Use the data
Everything is CC BY 4.0: JSON and CSV on GitHub, stable API endpoints (/api/v1/cves.json), a DOI for citing a fixed version (10.5281/zenodo.24054569), a Hugging Face mirror and a Kaggle mirror. The statistics page recomputes all numbers on every build: promptinjections.de/threat-index/zahlen
The site itself is in German; the data and the README are not.
Disclosure: I run promptinjections.de.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.