🔍 Read the full analysis: CVE Data Shows A Growing Challenge Between Discovery And Patching on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A review of NVD and CVE.org records counted 13,934 CVEs published from Oct. 1–25, 2026, compared with 4,389 in all of October 2025. The figures show a sharp rise in disclosed vulnerabilities, but do not establish how much AI caused it; Anthropic says only 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge.
A review of public vulnerability records found 13,934 new CVE records published from Oct. 1 through Oct. 25, 2026, more than three times the 4,389 records in all of October 2025. The rise comes as security researchers and companies use AI tools to find software flaws, but the available data does not show how much of the increase AI caused—and figures from Anthropic point to a substantial gap between reported flaws and known fixes.
The analysis, published by ThorstenMeyerAI.com on Oct. 26, says it queried the National Vulnerability Database’s CVE API for records by publication date and cross-checked October entries against CVE.org. Its account reports 13,766 October records in the NVD, plus 202 records later rejected, while the Oct. 1–25 total across the article’s count is 13,934. The figures reflect published records, not a direct count of newly discovered bugs or vulnerabilities currently exploitable in the wild.
The report puts the 2026 total at 88,772 as of its data pull, 78% above the full-year 2025 total. It also says the daily publication rate rose from 267 in June to 502 in September, while the rate through Oct. 25 was 557 per day. The author describes October’s increase in the daily rate as about 11%, slower than the month-to-month rises reported from June through September. A projection of roughly 17,000 records by month-end is an estimate, not a final count.
The increase is concentrated among several organizations. The report counts 1,455 Microsoft records in October, compared with 180 a year earlier; Oracle rose from 78 to 1,078, and GitHub from 276 to 1,159. The article attributes much of the monthly change to large vendors and vulnerability-numbering organizations, rather than a uniform rise across all software projects.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Fix Queue Behind the Surge
A growing number of disclosures can strain the teams responsible for checking, prioritizing and deploying patches. The count of published CVEs alone does not tell an organization which flaws are reachable in its systems, being exploited, or urgent to fix. But when disclosure volumes rise sharply, defenders may have more issues to triage at once, especially where software inventories and patch processes are incomplete.
The report cites Anthropic’s disclosure dashboard, which listed 6,157 vulnerabilities reported to maintainers. Anthropic said that, to its knowledge, 516 had been patched—about one in twelve. That is a snapshot of one organization’s reported findings and its knowledge of their status, not a measure of the overall patch rate across software. It nevertheless illustrates the operational distance between identifying a flaw and confirming that a fix is available and deployed.
For readers and organizations, the practical implication is that discovery figures should not be treated as a proxy for immediate attack risk. The relevant questions are whether a flaw affects systems in use, whether exploitation has been observed, and whether a tested patch or mitigation is available. Public disclosure and remediation are separate stages, and neither the CVE count nor the reported patch figure answers all of those questions.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the October Count Was Built
A CVE is a public identifier assigned to a disclosed vulnerability through the CVE program. The source article says records are generally published by a CVE Numbering Authority, often a vendor, following coordinated disclosure. That means CVE totals describe the public reporting process; they do not count every privately known flaw, and they do not identify every person or tool that originally found one.
For October, the analysis says 98% of records carried a 2026 identifier and the median time between reserving an identifier and publishing it was 15 days. It argues these details weigh against the increase being solely a release of old records, while acknowledging that the published data cannot establish the full discovery timeline for each flaw.
The report also examined finder credits. Of 13,934 October records, it says 6,346 named a finder. It counted 200 records, or 1.4%, that explicitly credited an AI lab, AI model or AI security firm. The author cautions that this is a floor: missing or inconsistent attribution means the share of AI-assisted discoveries cannot be calculated from those credits alone. Separately, Anthropic reported that external reviewers confirmed 92.7% of 6,123 candidate vulnerabilities it examined, and that the company had reported 6,157 findings to maintainers. OpenAI’s Patch the Planet program with Trail of Bits reported hundreds of security issues across 19 open-source projects, with manual review, according to the source.
“The real risk sits after the discovery.”
— Thorsten Meyer, ThorstenMeyerAI.com
What the Records Cannot Show
The October total is a dated snapshot, not a final full-month count. The article’s roughly 17,000-record month-end figure is a projection based on the pace through Oct. 25. The supplied source also gives different October totals for the NVD count and the combined count that includes later-rejected records, so the precise treatment of rejected entries should be kept in view when comparing figures.
Public records do not establish how many vulnerabilities were found with AI, how many were found independently by people, or how many are actively exploited. Finder details are absent from more than half of the October records in the report’s review. The source mentions CISA’s Known Exploited Vulnerabilities catalog and says it added 245 entries in 2025, but the supplied material ends before giving a comparable 2026 total. It therefore does not support a complete comparison between the CVE surge and confirmed exploitation.
The patch figure also has limits: Anthropic’s count reflects what the company knew at the time of its dashboard, and the source does not provide a shared definition or independently verified status for every reported vulnerability. It remains unclear how many affected systems have received fixes, how long remediation takes across the wider software ecosystem, and how much of the overall increase reflects changed discovery, reporting or publication practices.
October Totals and Patch Status
The October record count can be checked against the final published totals after the month closes. A fuller comparison would also require consistent figures for rejected records, reporting dates and publication dates, along with more complete finder attribution. Those details would help establish whether the rise continues at the same pace and how much it reflects changes in the reporting pipeline.
For remediation, the next useful measures are the status and timing of fixes across affected projects, including whether maintainers issue patches and whether organizations deploy them. CISA’s exploited-vulnerability catalog can offer a separate view of flaws known to be used in attacks, but the source material does not provide enough 2026 data to determine whether exploitation is rising alongside disclosures. Until those figures are available, the confirmed picture is a surge in published records and a substantial reported gap between findings and known patches—not a quantified surge in attacks.
Key Questions
How many CVE records were published in October 2026?
The source analysis counted 13,934 records from Oct. 1–25. It also reports 13,766 October records in the NVD plus 202 later-rejected records. The full-month total was not yet available when the analysis was published.
Does the increase prove AI is finding most vulnerabilities?
No. The source says only 200 October records, or 1.4%, explicitly credited an AI lab, model or AI security firm. Finder information was missing from 54% of records, so those credits cannot establish AI’s full contribution.
How many Anthropic-reported vulnerabilities were patched?
Anthropic’s dashboard, as cited in the report, said 516 of 6,157 vulnerabilities reported to maintainers were patched to the company’s knowledge. This is a company-specific snapshot, not an ecosystem-wide patch rate.
Do more CVEs mean more attacks are happening?
Not by themselves. CVE records document public vulnerability disclosures; they do not show how many flaws are being exploited. The supplied source does not provide a complete 2026 comparison with CISA’s exploited-vulnerability catalog.
Source: ThorstenMeyerAI.com
