🔍 Read the full analysis: Why More CVEs Don’t Always Mean Faster Fixes on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The source analysis reports 13,934 CVE records published from Oct. 1–25, 2026, 3.2 times the total for all of October 2025. But the records do not show how much AI contributed, and Anthropic says only 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge.
An analysis published Oct. 26, 2026, found 13,934 new CVE records were published from Oct. 1 through Oct. 25, more than three times the full October 2025 total, but the increase does not show that software is being fixed faster. The figures draw on the U.S. National Vulnerability Database and CVE.org; separate data cited by the analysis shows that many reported flaws remain without a known patch.
The analysis says the October 1–25 tally was 3.2 times October 2025’s 4,389 records. It also reports 88,772 records so far in 2026, 78% above the total for all of 2025. These are publication counts, not a direct measure of newly exploited software or completed repairs. The author says the NVD and CVE.org records agree on the October count when rejected records are handled separately.
The rise is concentrated among a small number of organizations. Microsoft published 1,455 records in October, compared with 180 in October 2025; Oracle went from 78 to 1,078, and GitHub from 276 to 1,159. The analysis says Oracle’s increase was largely recorded on Oct. 20. It also reports that the rate of growth slowed: monthly daily averages rose 20% from June to July, 28% from July to August and 22% from August to September, then about 11% in October so far.
Disclosure records offer limited evidence about who discovered each vulnerability. Of the October records, 6,346, or 46%, named a finder; 200, or 1.4%, explicitly credited an AI lab, AI model or AI security firm. The author cautions that this is a floor, not a complete estimate, because most records do not identify a finder. A CVE record documents a vulnerability disclosure; it does not establish that AI found the bug or that it was exploited.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
More Disclosures, Unfinished Repairs
The practical security benefit of finding flaws depends on whether maintainers can assess them, prepare fixes and get those fixes to users. A rising CVE count can reflect more flaws being discovered or more records being published, but it does not show that affected software has been patched, that users have installed updates, or that attackers are exploiting the flaws.
The gap appears in figures attributed to Anthropic’s vulnerability disclosure dashboard. As of Oct. 2, the company listed 6,157 vulnerabilities reported to maintainers and said 516 were patched to its knowledge—about one in twelve. This is a company-reported snapshot, not a complete measure of every report’s status. Still, it illustrates why a large discovery pipeline can leave defenders with a substantial queue of work.
For organizations responsible for software, the distinction matters when setting priorities. Counting new disclosures alone can obscure whether the most exposed products have fixes available and whether those fixes have reached users. The analysis argues that the key measure is not just how many flaws are found, but how quickly the full repair process progresses.
Products Worth Considering
Levoit Vital 200S-P Smart Air Purifier for Large Rooms
iRobot Roomba Max 715 Pet Robot Vacuum with AutoEmpty Dock
Bose TV Speaker (2nd Gen) Compact Soundbar with Bluetooth and HDMI Connectivity
As an affiliate, we earn on qualifying purchases.
How the October Count Was Built
The author queried the NVD CVE API 2.0 for records by publication date from January 2022 onward and cross-checked October entries against CVE.org. The figures were retrieved on Oct. 26 at 07:16 UTC. The article reports 13,766 October records in the NVD count, plus 202 records later rejected, for 13,934 records in its October 1–25 headline figure. The available source text does not fully explain the timing and counting treatment behind every difference between those figures, so they should be read with that caveat.
The analysis says 98% of October records had a 2026 CVE identifier and that the median time between reserving an identifier and publication was 15 days. That supports the author’s view that the increase was not chiefly a dump of older records. The October daily count averaged 557 records, compared with 142 per day in October 2025. A projected month-end total near 17,000 is explicitly the author’s projection if the pace holds, not an observed final count.
CVE records are issued through coordinated disclosure, often by a vendor or another CVE Numbering Authority. The analysis notes that criminals do not file CVEs; even when exploitation is discovered first, a record can reflect a defender’s later response. That means the records describe public disclosure activity, not a complete account of who initially found a flaw or how it was used.
What the Counts Cannot Show
The records do not establish how much AI contributed to the surge. Only 1.4% of October records explicitly credited an AI lab or AI security firm, while 54% named no finder. Those figures leave the discovery method unknown for most records; they cannot establish either that AI played a minor role or that it drove most of the increase.
Patch status is also incomplete. Anthropic’s figure reflects what the company knew as of Oct. 2, and the source does not provide a comparable, independently verified status for every vulnerability in the broader CVE total. Nor does a published CVE by itself show whether a flaw is exploitable in a specific deployment, whether a fix is available, or whether users have installed it.
The source excerpt begins discussing CISA’s Known Exploited Vulnerabilities catalog but does not provide the full comparison figures or its conclusion. It therefore does not support a precise claim about how exploitation changed relative to CVE publication. The final October count and the status of the reported patch queue also remain open.
Track Patches and October’s Final Count
The October tally will be clearer once the month ends and records are checked for later corrections or rejections. The source author’s estimate of nearly 17,000 records for October depends on the pace through Oct. 25 continuing; it is not a confirmed result.
The more consequential follow-up is the status of disclosed vulnerabilities: which maintainers have issued patches, how long repairs take, and whether organizations deploy them. Public dashboards and advisories can help track parts of that process, but the figures cited here do not provide a complete cross-industry patch timeline. Until such information is available, the CVE surge is evidence of increased disclosure activity—not proof of faster remediation or a measured rise in successful attacks.
Key Questions
How many CVE records were published in October 2026?
The analysis counts 13,934 records from Oct. 1–25, compared with 4,389 for all of October 2025. October’s final total was not yet available when the analysis was published.
Does the CVE increase show that AI found most of the flaws?
No. The analysis found that 200 October records, or 1.4%, explicitly credited an AI lab, model or AI security firm. Because 54% named no finder, the records cannot establish how much AI contributed overall.
Are the reported vulnerabilities being patched?
Anthropic’s dashboard, as reported in the analysis, listed 516 patched out of 6,157 vulnerabilities the company had reported to maintainers, to its knowledge as of Oct. 2. That snapshot does not describe the status of every CVE.
Does a CVE mean attackers are exploiting a vulnerability?
No. A CVE is a vulnerability record, not proof of exploitation. The source material does not provide enough figures to quantify how exploitation changed alongside the October disclosure increase.
Source: ThorstenMeyerAI.com
