🔍 Read the full analysis: What’s Driving CVE Discovery, And Why Is The Patch Gap Widening? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A review of NVD and CVE.org data counted 13,934 CVE records published from Oct. 1–25, 2026, more than three times the total for October 2025. The analysis says the data cannot establish how much AI contributed to discoveries, while Anthropic reports that 516 of 6,157 vulnerabilities it reported to maintainers were patched to its knowledge.
A review of U.S. National Vulnerability Database and CVE.org records found 13,934 CVE records published from Oct. 1–25, 2026, compared with 4,389 during all of October 2025. The analysis, published by ThorstenMeyerAI.com on Oct. 26, also points to a persistent repair bottleneck: Anthropic says 516 of 6,157 vulnerabilities it reported to open-source maintainers had been patched to its knowledge.
The figures count records by publication date, not newly discovered bugs during that period. The source analysis says its October 1–25 total includes 13,766 records that remained published and 202 later rejected; its headline count includes both categories. It cross-checked October records against CVE.org and says the sources agreed. The data was retrieved Oct. 26 at 07:16 UTC.
The October total was already more than 3.2 times October 2025’s full-month count. Across 2026, the analysis counted 88,772 records, 78% more than in all of 2025. The daily publication rate rose from 267 in June to 320 in July, 410 in August and 502 in September. For Oct. 1–25, it averaged 557 per day. The author says October’s rate of growth slowed to about 11%, after monthly increases of 20% to 28% from June through September.
The rise is concentrated among a handful of publishers and numbering authorities. Microsoft accounted for 1,455 October records, compared with 180 in October 2025; Oracle had 1,078, and VulnCheck 2,085, according to the analysis. It says 98% of October records had a 2026 identifier and the median time between reserving an identifier and publication was 15 days. That suggests the jump is not simply a large release of older records, though the figures do not explain why each organization’s totals grew.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Fix Queue Is the Key Risk
A larger CVE count means more publicly documented vulnerabilities that organizations may need to evaluate, prioritize and patch. It does not, by itself, show that attacks have risen at the same rate, or that every entry presents the same level of danger. The analysis argues the practical risk lies in whether fixes reach users quickly enough, especially across widely used software and open-source projects.
Anthropic’s figures illustrate the gap but should be read as a company-reported snapshot, not a complete measure of the industry. Its dashboard, as of Oct. 2, listed 29,439 candidate vulnerabilities found by Claude models. External firms reviewed 6,123 and confirmed 92.7% as real, while 6,157 had been reported to maintainers. Anthropic said 516 of those reported vulnerabilities were patched to its knowledge—about one in twelve. The source does not provide a comparable patch rate for other AI-assisted programs or for vulnerabilities found by conventional methods.
The distinction matters for security teams and software users. Discovery creates work: maintainers must verify reports, develop fixes and distribute them, while organizations must test and install updates. The analysis says the findings reported by Anthropic were associated so far with 219 CVE records and 365 GitHub advisories. Those totals show that reported research findings and published CVEs are not interchangeable measures.
Popular right now
eufy E25 Robot Vacuum and Mop Combo with HydroJet Roller Mop
TCL 85 Designer Series QD-Mini LED TV (Model 85A400U) with Google Smart TV
De'Longhi Dinamica Plus Fully Automatic Espresso Machine
As an affiliate, we earn on qualifying purchases.
What CVE Counts Can Show
A CVE is a public identifier for a disclosed vulnerability. In the source analysis, records are described as part of coordinated disclosure: a CVE Numbering Authority, often a vendor, publishes a record following a fix or a disclosure deadline. That means the person or organization listed as publishing a record is not necessarily the original finder. Nor does a CVE count establish whether attackers know about or are exploiting a flaw.
The records also leave gaps about attribution. Of the 13,934 October entries examined, 6,346, or 46%, named a finder. The analysis says 200 entries, or 1.4%, explicitly credited an AI lab or AI security firm. It characterizes that as a minimum rather than a full tally, since records often omit finder details. The low share cannot establish that AI played only a minor role in discovery.
Separately, Anthropic reported that outside reviewers confirmed 92.7% of 6,123 candidate findings they reviewed. OpenAI’s Patch the Planet program, carried out with Trail of Bits, reported “hundreds of security issues” across 19 open-source projects, with each reviewed by hand. These are company and program reports, not independently established totals for AI’s share of all vulnerability discovery.
Attribution and Exploitation Gaps
The available records do not establish how much of the CVE rise was caused by AI tools. More than half of the October entries named no finder, and the 1.4% that explicitly credited an AI lab or security firm is not a reliable estimate of AI’s overall contribution. The analysis also cannot show from these counts whether AI increased the number of vulnerabilities found, made reporting faster, or changed disclosure practices.
The source material begins a comparison with CISA’s Known Exploited Vulnerabilities catalog, describing it as a public measure of known exploitation and saying it added 245 entries in 2025. It does not supply the later-year figures or enough detail to assess exploitation trends alongside the CVE surge. The excerpt also reports claims that attackers are using inexpensive AI agents against older bugs and that a Chinese open-weight model can build exploits with weak safeguards, but it does not provide supporting evidence or detailed attribution for those claims. They should not be treated here as independently confirmed findings.
The patch figure has limits, too: Anthropic says 516 vulnerabilities were patched “to its knowledge,” but the source does not define the verification process, give a reporting cutoff for each finding, or explain how many maintainers responded. It is also unclear how many entries are duplicates, affect software no longer maintained, or present immediate risk in deployed systems.
Tracking Fixes and Exploitation
The next useful indicators are whether the high publication pace continues, how many records are ultimately rejected or revised, and whether the rise remains concentrated among a small group of organizations. The source author estimated that October could end near 17,000 records if the pace held, but identified that figure as a projection, not a final count.
For the patch gap, follow-up data from Anthropic and other disclosure programs would help show how quickly maintainers acknowledge, verify and fix reports. CISA’s updated Known Exploited Vulnerabilities catalog can provide a separate view of vulnerabilities that authorities identify as exploited, though it does not capture every attack. Until comparable, dated figures are available, the CVE surge and claims about AI-enabled exploitation should be treated as distinct developments.
Key Questions
How many CVE records were published in October 2026?
The analysis counted 13,934 records from Oct. 1–25, including 202 records later rejected. It is not a full-month total.
Does the rise prove AI is finding most vulnerabilities?
No. The source analysis says 54% of October records named no finder, and 1.4% explicitly credited an AI lab or security firm. Because attribution is often missing, those figures cannot determine AI’s overall contribution.
What does Anthropic report about patching?
Anthropic said it had reported 6,157 vulnerabilities to maintainers and that 516 were patched to its knowledge. The source does not provide an industry-wide comparison.
Does a higher CVE count mean attacks are increasing?
Not by itself. CVE publication counts track documented disclosures, not the number of attacks. The source material does not include enough later-year CISA exploitation data to compare the October surge with confirmed exploitation.
Source: ThorstenMeyerAI.com
