🔍 Read the full analysis: The CVE Data Story: More Discovery, Patch Delays, And AI on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A review of NVD and CVE.org records counted 13,934 CVEs published from October 1–25, 2026, compared with 4,389 during all of October 2025. The review says the increase is concentrated among a handful of vendors and that CVE records do not establish how much AI contributed. It also cites Anthropic’s report that 516 of 6,157 vulnerabilities it disclosed to maintainers are patched to its knowledge.
A review of U.S. National Vulnerability Database and CVE.org records found 13,934 CVE records published from October 1 through October 25, 2026—more than three times the 4,389 recorded during all of October 2025. The figures point to a sharp rise in publicly recorded software vulnerabilities, but the analysis says the data cannot show how much artificial intelligence contributed to finding them; it also highlights delays between reporting flaws and confirming that they have been patched.
The analysis, published by Thorsten Meyer on October 26, says it queried the NVD CVE API for records by publication date and cross-checked October entries against CVE.org. It reports 13,766 October records and 202 records later rejected, for a total of 13,968 published entries in the period. Its separate comparison table counts 13,934 records for October 1–25. The source does not reconcile that difference, so the totals should be read with that caveat.
The review says the increase is concentrated among a small number of organizations. Microsoft’s October count rose from 180 records in October 2025 to 1,455 this October; Oracle rose from 78 to 1,078, and VulnCheck from 163 to 2,085. The analysis attributes Microsoft’s figure in part to its October security release, citing SecurityWeek. It reports that 98% of October records had 2026 CVE identifiers and that the median interval between reserving an identifier and publication was 15 days.
Attribution is incomplete: only 6,346 of 13,934 records—46%—named a finder, according to the review. It counted 200 records, or 1.4%, that explicitly credited an AI lab or security firm. Those figures are not a measure of AI’s total role: many records lack finder information, and some AI-assisted discoveries may not be identified as such.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Fixing Gap Behind the Surge
A higher disclosure count can mean more software flaws are being found and made public, but it does not by itself show that more flaws are being exploited or that users are facing an equivalent increase in immediate risk. For organizations responsible for software, the practical question is whether maintainers can assess reports and deliver fixes quickly.
The analysis cites Anthropic’s disclosure dashboard, which said that, as of October 2, it had reported 6,157 vulnerabilities to maintainers and knew of 516 patches. That is about one in twelve of the reported flaws, based on the company’s figures. The number reflects Anthropic’s knowledge and reporting process, not an independent count of every fix; the source does not provide a comparable patch rate across the software industry.
The review also points to attackers’ use of inexpensive AI agents against older vulnerabilities, citing NorForge and Reuters. That claim is distinct from the CVE totals: a disclosure count does not establish how many records are being exploited. For defenders, the combination of more reports and an uncertain repair timeline makes patch capacity and prioritization central concerns.
Products Worth Considering
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black
DJI Osmo Mobile 8 3-Axis Smartphone Gimbal Stabilizer
Sonos Era 100 Wireless Smart Speaker, Black
As an affiliate, we earn on qualifying purchases.
How the October Count Was Built
Meyer says the NVD query covered records published since January 2022 and used the API’s publication-date fields, included all statuses, and was retrieved on October 26 at 07:16 UTC. The October records were cross-checked against CVE.org. The analysis reports 3,595 records in October 2024 and 4,389 in October 2025, compared with 8,001 in June 2026, 9,919 in July, 12,719 in August and 15,074 in September.
Those monthly figures are not all identical time windows: October 2026 covers only the first 25 days in the comparison table. The review reports an average of 557 records a day for that period. It says daily volume increased by 20% from June to July, 28% from July to August and 22% from August to September, then rose about 11% in October so far. Its estimate that October could end near 17,000 is a projection, not an observed total.
A CVE record documents a disclosed vulnerability; it does not identify every person or tool involved in discovery. The review says a CVE is generally published by a numbering authority, often a vendor, following coordinated disclosure. That means CVE counts track public disclosures, not a complete census of discoveries or attacks. The source also cites OpenAI’s Patch the Planet program with Trail of Bits, which reported hundreds of security issues across 19 open-source projects, with each reviewed by people.
What the Records Cannot Establish
The October totals differ within the source: its key takeaways give 13,934 new records, while its methods section reports 13,766 records plus 202 later rejected. The article does not explain the discrepancy. Its October 1–25 comparison is also not a full-month comparison with October 2025.
Because 54% of the records name no finder, the analysis says its count of AI-linked disclosures is a floor, not a full estimate. It cannot determine how much AI contributed to finding the vulnerabilities, how often AI-assisted discoveries went uncredited, or whether the rise in CVEs reflects a lasting change in reporting practices.
The supplied source material ends before giving its full figures for CISA’s Known Exploited Vulnerabilities catalog. It says the catalog grew in 2025 but not at the rate of CVE disclosures; without the remaining numbers, a precise comparison of newly disclosed flaws and known exploitation cannot be reported here. The reported patch count also depends on Anthropic’s own knowledge and is not an independently audited measure.
Watch Patch Rates and Exploitation
The next useful indicators are whether the high disclosure volume continues in full-month and later-period data, whether maintainers publish fixes for the reported flaws, and whether CISA adds more known-exploited vulnerabilities. Those measures would help distinguish a surge in discovery and reporting from a corresponding rise in confirmed exploitation.
Meyer’s estimate of nearly 17,000 records for October should be checked against the final month’s count; it is a projection based on the pace through October 25. Further comparisons will also need consistent date ranges and reconciled CVE totals. Until then, the clearest conclusion is limited: public disclosures have risen sharply in the source’s count, while the available records do not establish AI’s overall contribution or the industry-wide pace of patching.
Key Questions
How many CVE records did the analysis count in October?
Its headline figure is 13,934 records from October 1–25, 2026. The methods section separately reports 13,766 records plus 202 later rejected; the source does not reconcile the totals.
Does the increase prove that AI found most of the vulnerabilities?
No. The review found that 200 records, or 1.4% of its October count, explicitly credited an AI lab or security firm, but 54% named no finder. The analysis says CVE records cannot measure AI’s full contribution.
What does Anthropic report about patching?
Anthropic’s dashboard, as cited in the analysis, said the company had reported 6,157 vulnerabilities to maintainers and knew of 516 patches as of the report’s stated time frame. That is the company’s reported knowledge, not an independent industry-wide patch rate.
Does a higher CVE count mean more attacks?
Not by itself. CVE counts track public vulnerability disclosures, not confirmed exploitation. The source says attackers are using AI agents against older bugs, but the supplied figures do not establish how many October disclosures are being exploited.
Source: ThorstenMeyerAI.com
