🔍 Read the full analysis: CVE Counts Are Climbing: How AI And Bug Hunters Fit The Picture on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A review of NVD and CVE.org records found 13,934 CVEs published from Oct. 1–25, 2026, 3.2 times the full October 2025 total. The increase is concentrated among several large vendors and numbering organizations, and public records identify an AI lab or security firm as finder in only 1.4% of October entries. Anthropic says 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge, underscoring that disclosure counts do not show how quickly fixes reach users.
A review of public vulnerability records found 13,934 new CVEs published from Oct. 1–25, 2026, more than three times the 4,389 recorded during all of October 2025. The figures show a steep increase in disclosed software flaws, but do not establish how many were found with AI or how many pose an immediate threat; the more consequential question may be how quickly maintainers and vendors fix them.
The figures come from a data analysis published Oct. 26 by Thorsten Meyer, which queried the U.S. National Vulnerability Database and cross-checked October records against CVE.org. The review counted records by publication date, including all statuses, and found 13,766 October records plus 202 later rejected. The two sources agreed on the record set, according to the analysis. Of the October entries, 98% carry a 2026 CVE identifier, and the median time between reserving an identifier and publication was 15 days.
The count is not evenly distributed across organizations. Microsoft had 1,455 records in October, compared with 180 a year earlier; Oracle had 1,078, compared with 78. GitHub’s count rose from 276 to 1,159, and VulnCheck’s from 163 to 2,085. The Linux kernel count increased from 660 to 925. The analysis says Microsoft’s October total was shaped by a Patch Tuesday release that addressed 1,413 CVEs, citing SecurityWeek.
The pace is high, but the analysis does not support describing it as accelerating without limit. Average daily publication rose from 267 in June to 320 in July, 410 in August and 502 in September. For Oct. 1–25, it was 557 per day. The analysis estimates the October daily rate rose about 11% from September, a slower increase than in the prior monthly comparisons. Its estimate that October could finish near 17,000 records is a projection, not a final count.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
Why Patch Delays Matter
A higher CVE count can mean more flaws have been documented, but it does not by itself measure the number of attacks, the severity of vulnerabilities or the risk to a particular organization. CVEs record disclosures; many entries concern issues that differ greatly in exploitability and impact. For security teams, the increase may mean more records to triage, but prioritization must account for affected products, available fixes and evidence of exploitation rather than relying on volume alone.
The repair figures in the source analysis point to a practical constraint. Anthropic’s disclosure dashboard, as reported by Meyer, listed 6,157 vulnerabilities reported to maintainers and said 516 were patched to the company’s knowledge. That is about one in twelve, but it is a company-reported snapshot, not a complete, independently verified measure of all fixes. Still, it illustrates why discovering flaws is only one part of reducing risk: maintainers need to verify reports, prepare corrections and distribute them, and users then need to install updates.
Meanwhile, an increase in published CVEs should not be read as proof that AI has caused an equivalent rise in successful attacks. The analysis says the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog grew by 245 entries over all of 2025, far less than the reported CVE rise. That comparison covers different periods and measures, however, and the source material does not provide a comparable 2026 KEV total. It cannot establish the current rate of exploitation.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Apple iPad Air 11-inch (M2), 512GB, Wi-Fi, Space Gray
As an affiliate, we earn on qualifying purchases.
What October’s CVE Data Shows
A CVE is a public identifier for a disclosed vulnerability, commonly assigned through a CVE Numbering Authority, or CNA. In coordinated disclosure, a vendor or other CNA may publish details after a fix is available or after a disclosure deadline. A CVE record can therefore document defenders’ handling of a flaw; it does not identify every person who first discovered it, and it is not a count of attacks.
That distinction matters when assessing claims that this year’s increase comes from AI. In Meyer’s review of 13,934 October records, 6,346, or 46%, named a finder. Only 200 records, or 1.4%, explicitly credited an AI lab or AI security firm as a finder, reporter or tool. Meyer notes that this is a floor because records often omit the finder and may not describe tools used. The count cannot establish AI’s share of discoveries.
Companies have reported substantial AI-assisted vulnerability research, but those figures are not directly interchangeable with CVE totals. Anthropic’s dashboard, as of Oct. 2, listed 29,439 candidate vulnerabilities found by Claude models; external firms reviewed 6,123 and confirmed 92.7% as real, according to the source analysis. Anthropic said 6,157 had been reported to maintainers. Those findings were associated with 219 CVE records and 365 GitHub advisories at the time. OpenAI’s Patch the Planet program with Trail of Bits reported “hundreds of security issues” across 19 open-source projects, each reviewed by people.
What the Records Cannot Establish
The public records do not reveal how much AI contributed to the October rise. More than half of the entries name no finder, and a CVE may not disclose whether a researcher used an AI model or another tool. The 1.4% explicitly credited to AI labs or security firms is therefore a documented minimum, not an estimate of AI’s overall role.
It is also unclear from the supplied data how many October vulnerabilities were actively exploited, how severe the newly published records were as a group, or how many fixes have since been released and installed. The reported 516 patched cases are limited to Anthropic’s knowledge and the date of its dashboard snapshot. The source material mentions attackers using low-cost AI agents against older bugs, citing NorForge and Reuters, but provides no underlying figures or specific examples to assess the scale of that activity.
Finally, the October count is incomplete because it covers only the first 25 days of the month. The projection near 17,000 assumes the pace holds and should not be treated as an observed total. The review also does not demonstrate that AI caused the broader rise: the large increases at Microsoft, Oracle, GitHub and VulnCheck show that changes in vendor releases and record handling are part of the picture.
Track Fixes and Exploitation
The next useful checks are the final October CVE total and updated records showing whether maintainers have issued patches. Security teams can compare new disclosures with vendor advisories and CISA’s Known Exploited Vulnerabilities catalog, while checking whether affected software is actually deployed in their environments. Counts alone cannot determine which systems need immediate attention.
Further evidence will also be needed to measure AI’s contribution: clearer disclosure of tools used, consistent reporting of finder information, and independently reviewed results that distinguish candidate findings from confirmed vulnerabilities. Until then, CVE totals can show the scale of publication, but not the share attributable to AI, the number of flaws being exploited or the speed at which users are protected.
Key Questions
How many CVEs were published in October 2026?
The review counted 13,934 records from Oct. 1–25, including 13,766 October records and 202 later rejected. The figure is not a final full-month total.
Do the figures show that AI caused the CVE increase?
No. Only 200 October records, or 1.4%, explicitly credited an AI lab or security firm, while 54% named no finder. Those omissions mean the public records cannot measure AI’s full contribution.
Does a higher CVE count mean more attacks?
No. A CVE documents a vulnerability disclosure; it does not confirm that attackers are exploiting the flaw. The supplied analysis does not provide a comparable October 2026 total for known exploited vulnerabilities.
What do the patch figures indicate?
Anthropic said it had reported 6,157 vulnerabilities to maintainers and that 516 were patched to its knowledge. This is a company-reported snapshot, not a complete measure of fixes across software.
Source: ThorstenMeyerAI.com
