🔍 Read the full analysis: Why CVE Discovery Is Outpacing Patching: What The Data Shows on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A source analysis of NVD and CVE.org records found 13,934 new CVE records published from Oct. 1–25, 2026, compared with 4,389 across all of October 2025. The increase is concentrated among a few major vendors and does not show how many flaws AI tools found; separate figures from Anthropic indicate that many reported vulnerabilities remain unpatched to its knowledge.
New vulnerability disclosures have surged: 13,934 CVE records were published from Oct. 1 through Oct. 25, 2026, compared with 4,389 during all of October 2025, according to an analysis of U.S. National Vulnerability Database and CVE.org records. The figures show faster discovery and disclosure, but they do not establish how many flaws were found with artificial intelligence or how many are exploitable; separate figures from Anthropic point to a substantial gap between reports and known patches.
The analysis queried the NVD CVE API for records by publication date and cross-checked October entries against CVE.org. It counted 13,766 October records and identified a further 202 that were later rejected, producing a total of 13,934 for Oct. 1–25. The author says the sources agree on the 13,766 published records. The distinction matters: the total includes records subsequently rejected, while the published-record count does not.
The pace was higher than in earlier months: the analysis counted 8,001 records in June, 9,919 in July, 12,719 in August and 15,074 in September. October’s first 25 days averaged 557 records per day, compared with 502 per day in September. The source describes monthly growth in the daily rate as slowing to about 11% in October, after increases of 20% to 28% from June through September. Its estimate that October could finish near 17,000 is a projection, not a final count.
The increase is concentrated among large vendors and vulnerability-data organizations. Microsoft records rose from 180 in October 2025 to 1,455 in the first 25 days of October 2026; Oracle’s rose from 78 to 1,078. GitHub entries rose from 276 to 1,159, and VulnCheck’s from 163 to 2,085. The source attributes Microsoft’s jump in part to an October Patch Tuesday that SecurityWeek reported included fixes for 1,413 CVEs. These totals count records, not necessarily unique products, incidents or actively exploited flaws.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
More Disclosures, More Work for Maintainers
A larger disclosure count can help defenders identify and track weaknesses, but a published CVE is not the same as a repaired system. The data puts attention on what happens after a flaw is reported: maintainers need to confirm it, develop and distribute a fix, and users need to apply that fix. Until those steps are complete, a disclosure may leave organizations with work to do rather than a resolved risk.
Anthropic’s dashboard, as described in the source, lists 6,157 vulnerabilities reported to maintainers and 516 patched to the company’s knowledge. That is roughly one in twelve, based on those figures. It is not a universal patch rate: the count covers Anthropic’s reported findings, and the source does not establish that all reports are equally severe, independently verified or still awaiting a fix. It does, however, illustrate why disclosure totals alone are an incomplete measure of security progress.
The consequences extend to organizations that depend on software maintained by others. A high volume of new records can add pressure to security teams deciding which updates to prioritize, while a slow or unknown fix status can complicate that work. The source also cites Reuters reporting that attackers are using low-cost AI agents against older bugs. That claim underscores the possible cost of delayed remediation, but the CVE counts themselves do not measure attacker activity or show that the newly disclosed flaws are being exploited.
Products Worth Considering
Ledger Flex + Folio Crypto Hardware Wallet
Ledger Flex Crypto Wallet
Logitech MX Keypad Programmable Macro Pad, Graphite
As an affiliate, we earn on qualifying purchases.
What the October CVE Counts Measure
A CVE is a public identifier for a disclosed cybersecurity vulnerability. Records are published through the CVE system, with vendors and other authorized numbering authorities commonly coordinating disclosure. The source argues that this makes the increase a rise in recorded disclosures, not a direct count of vulnerabilities independently discovered by AI or of attacks. Criminals do not typically file CVEs; a record may instead document a flaw after a defensive discovery or response.
The records provide limited information about who originally found each issue. Of 13,934 October entries in the source’s count, 6,346 named a finder. The other 54% did not. The author found 200 entries—1.4% of the total—that explicitly credited an AI lab or AI security firm as a finder, reporter or tool: 123 associated with Anthropic or Claude, 65 with AI security companies and 16 with OpenAI. The article calls that a floor because credits may be missing or recorded in other ways; it is not a complete estimate of AI’s contribution.
Anthropic’s dashboard figures add a separate view of AI-assisted research. As of Oct. 2, it listed 29,439 candidate vulnerabilities found by Claude models; external firms reviewed 6,123 and confirmed 92.7% as real. The company said 6,157 had been reported to maintainers. These categories are not interchangeable with CVE records: the source says the findings were associated so far with 219 CVEs and 365 GitHub advisories. OpenAI’s Patch the Planet program with Trail of Bits reported hundreds of security issues across 19 open-source projects, with manual review, according to the source.
What the Records Cannot Establish
The October figures are a snapshot through Oct. 25, not a full-month total, and the source includes 202 records later rejected in its 13,934 figure. Its projected finish near 17,000 depends on the pace continuing and should not be treated as an observed result. The supplied material does not include the remainder of its discussion of CISA’s Known Exploited Vulnerabilities catalog, so it does not support a complete comparison between CVE publication growth and confirmed exploitation.
It is also unclear how much of the increase was caused by AI tools. More than half of the October records name no finder, and explicit AI credits appear in only a small share. Those fields may undercount AI involvement, but they cannot prove that uncredited discoveries were AI-assisted. Nor do the available figures establish the severity, exploitability or patch status of every record, or provide a representative patch rate across the software industry.
Track October Totals and Fix Status
The next check is the final October publication count, including whether the month ends near the source’s projected 17,000 records. Subsequent updates to NVD and CVE.org can also clarify which records remain valid and whether more disclosures identify a finder. These databases provide ongoing counts, but a change in the total will not by itself explain the cause of the increase.
For the patching question, the relevant follow-up is whether maintainers confirm and fix reported flaws, and whether organizations deploy those updates. Anthropic’s patch figure is limited to its knowledge and its own reported findings; updated dashboard data could change that snapshot. The source also points to CISA’s exploitation catalog as a separate indicator, but the supplied material does not give its current 2026 total. Until comparable figures are available, the scale of confirmed exploitation relative to the disclosure surge remains unsettled.
Key Questions
How many CVE records were counted in October 2026?
The source counted 13,934 records from Oct. 1–25, including 202 that were later rejected. It separately reports 13,766 published records in October after excluding those rejected entries. The month was not complete when the data was retrieved.
Does the increase show that AI found most of the vulnerabilities?
No. The CVE records do not provide complete finder information: 54% of the October entries named no finder, and 1.4% explicitly credited an AI lab or AI security firm. The source says that figure may undercount AI involvement, but it cannot establish how much AI contributed overall.
How many Anthropic-reported vulnerabilities had been patched?
Anthropic’s dashboard listed 516 patched out of 6,157 vulnerabilities it had reported to maintainers, to the company’s knowledge as of the source’s reporting. This is a company-specific figure, not an industry-wide patch rate.
Does a CVE record mean a vulnerability is being exploited?
No. A CVE is a disclosure record, not proof of exploitation. The source says attackers are using AI agents against older bugs, citing Reuters, but the October CVE totals alone do not show which flaws are under active attack.
Source: ThorstenMeyerAI.com
