🔍 Read the full analysis: Are CVEs Heading To The Moon? AI, Bug Hunters, And Patch Delays on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A source analysis of NVD and CVE.org records found 13,934 new CVE records published from Oct. 1–25, 2026, more than three times October 2025’s full-month total. The data does not identify AI as the cause of most findings, while Anthropic says only 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge.
New CVE publications have risen sharply in 2026, with 13,934 records published from Oct. 1–25, according to an analysis of NVD and CVE.org data. The figures confirm a steep increase in public vulnerability disclosures, but they do not establish that AI caused most of the discoveries; the same analysis points to patching delays as a key concern after flaws are reported.
The analysis, published by Thorsten Meyer on Oct. 26, counted CVE records by publication date. It reported 13,934 records for the first 25 days of October, compared with 4,389 during all of October 2025. The 2026 total through Oct. 25 was 88,772, which the analysis said was 78% above the full-year 2025 count. The comparison periods differ: October 2026 is partial, while October 2025 is complete.
The monthly daily rate rose from 267 records in June to 320 in July, 410 in August and 502 in September. October’s rate through the 25th was 557 per day. Meyer said the rate of growth had slowed in October compared with earlier month-to-month increases. His estimate that October could end near 17,000 records is a projection, not a final count.
The increase was concentrated among several organizations. The analysis counted 1,455 October records associated with Microsoft, compared with 180 in October 2025; Oracle rose from 78 to 1,078, and VulnCheck from 163 to 2,085. These figures describe records associated with those organizations, not necessarily vulnerabilities found using AI. The analysis also found that 54% of October records did not name a finder, while 1.4% explicitly credited an AI lab or AI security firm.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Fixing Gap Behind the Surge
A rising CVE count means more vulnerabilities are being publicly documented, but it does not show by itself how many are exploitable, how many are being targeted, or how quickly affected software is being fixed. For organizations responsible for software and systems, the practical risk depends partly on whether a disclosed flaw has a usable patch and whether that patch is deployed.
Anthropic’s dashboard, as cited in the analysis, listed 6,157 vulnerabilities reported to maintainers and 516 patched to the company’s knowledge. That is roughly one in twelve. The figures suggest a substantial gap between reporting and known fixes, although they do not establish how representative Anthropic’s findings are of all reported vulnerabilities or whether maintainers have made additional fixes not reflected in its dashboard.
The publication spike should not be treated as a direct measure of a corresponding rise in attacks. CVEs are public disclosure records; they are not a count of incidents or successful exploits. The analysis says CISA’s Known Exploited Vulnerabilities catalog grew less sharply than CVE publications, but the supplied figures do not include the full comparison needed to quantify that difference. The distinction matters: defenders need to track exploitation and patch status as well as disclosure volume.
Products Worth Considering
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
Jackery Solar Generator 1000 V2 with 200W Solar Panel
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
What the CVE Records Show
A CVE record gives a publicly recognized identifier to a disclosed vulnerability. The analysis describes records as part of coordinated disclosure: a vendor or other CVE Numbering Authority typically publishes the record after a fix or disclosure deadline. That process can make the record a sign of a defender’s response, but it does not necessarily identify who first discovered the underlying flaw.
For October, the analysis says it queried the NVD CVE API and cross-checked records against CVE.org. It counted 13,934 records in its period total, while a separate account in the same source says the underlying October records included 13,766 published records plus 202 later rejected. These figures are not fully reconciled in the material, so the precise treatment of rejected records and status categories is unclear. The source says 98% of October records carried a 2026 ID and reports a median of 15 days between ID reservation and publication.
AI-related discovery is documented, but the available records do not capture it comprehensively. The analysis counted 200 October records explicitly crediting an AI lab or security firm. It also cited Anthropic’s report of 29,439 candidate vulnerabilities found by Claude models; external firms reviewed 6,123 and confirmed 92.7% as real, according to Anthropic. The source says those findings had led to 219 CVE records and 365 GitHub advisories at the time. OpenAI’s Patch the Planet program with Trail of Bits reported “hundreds of security issues” across 19 open-source projects, with issues reviewed by people.
“That is a floor, not an estimate.”
— Thorsten Meyer, describing the CVE data
The record data does not show how much AI contributed to the overall rise. More than half of October records named no finder, and explicit AI attribution appears on only a small share. That makes the 1.4% figure a count of disclosed credits, not a reliable estimate of AI’s actual role. The available material also does not establish whether the growth reflects more discoveries, expanded vendor reporting, changes in numbering and disclosure practices, or a mix of factors.
Patch figures also have limits: Anthropic’s count reflects its own reported findings and what it knew to be patched, not a complete view of every maintainer’s current status. The supplied source ends before giving the full 2025 total for additions to CISA’s exploited-vulnerability catalog, so a numerical comparison with CVE growth cannot be verified here. It remains unclear how many newly disclosed flaws are being exploited, how many have fixes available, and how quickly affected organizations are applying them.
Track Fixes and Exploitation
The next useful checks are the completed October publication count, updates to CISA’s Known Exploited Vulnerabilities catalog, and clearer patch-status reporting from maintainers and security researchers. Those measures would help distinguish a rise in documented findings from a rise in flaws attackers are exploiting.
Organizations should assess disclosures against their own software inventories, prioritize vulnerabilities with evidence of exploitation, and monitor whether vendors have released fixes. The available information does not provide a timeline for a broader audit of the October records or a final month-end total. For now, the strongest supported conclusion is that public CVE publication has climbed sharply, while the role of AI and the scale of the resulting patch backlog remain incompletely measured.
Key Questions
How many CVE records were published in October 2026?
The analysis counted 13,934 records from Oct. 1–25. That is a partial-month figure, not October’s final total. Its source material also gives a separate breakdown of 13,766 published records plus 202 later rejected, which it does not fully reconcile with the headline count.
Does the surge prove AI is finding most vulnerabilities?
No. The record data explicitly credited an AI lab or security firm on 1.4% of October records, while 54% named no finder. Because attribution is incomplete, that percentage cannot establish AI’s true share of discoveries.
Are the new CVEs being actively exploited?
The CVE total does not answer that question. CVE records document disclosures, not confirmed attacks. The source says CISA’s exploited-vulnerability catalog grew less sharply, but the supplied material does not provide enough figures to quantify the comparison.
How many of Anthropic’s reported vulnerabilities were patched?
Anthropic’s dashboard listed 516 patched out of 6,157 vulnerabilities reported to maintainers, according to the analysis. The figure reflects Anthropic’s knowledge at the time and may not capture every fix made by maintainers.
Source: ThorstenMeyerAI.com
