🔍 Read the full analysis: How AI Is Changing The CVE Landscape, According To The Data on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A data review published Oct. 26 reports 13,934 CVE records from Oct. 1 through 25, 2026, compared with 4,389 in all of October 2025. The figures show a sharp rise in disclosed vulnerabilities, but CVE records do not establish how many were found with AI. The author says the slow rate of patching among vulnerabilities reported by Anthropic points to remediation as a key concern.
A review of public vulnerability records found 13,934 new CVE entries published from Oct. 1 through 25, 2026, more than three times the 4,389 recorded during all of October 2025. The review, published by Thorsten Meyer on Oct. 26, says the increase is real but that the data cannot establish how many vulnerabilities were found using AI; it also points to a gap between reported flaws and confirmed fixes.
Meyer queried the U.S. National Vulnerability Database (NVD) for records published since January 2022 and cross-checked the October entries against CVE.org. The sources agree on 13,766 October records and another 202 records later rejected. The review’s broader figure of 13,934 covers Oct. 1–25, while its comparison table lists 13,766 records for October; the source does not fully explain that difference. It reports that 88,772 CVEs had been published in 2026 by the time of the review, 78% more than during all of 2025.
The increase is not evenly distributed across publishers. Microsoft’s October records rose from 180 in October 2025 to 1,455 in October 2026; Oracle’s rose from 78 to 1,078, with nearly all of its October entries published on Oct. 20. GitHub increased from 276 to 1,159, and VulnCheck from 163 to 2,085. By comparison, Linux kernel records rose from 660 to 925. Meyer says a handful of vendors and vulnerability coordinators account for much of the increase.
The data offers limited evidence about who discovered the flaws. Of the 13,934 October entries, 6,346, or 46%, named a finder; 200, or 1.4%, explicitly credited an AI lab or AI security company. Meyer cautions that this is a floor, not a full measure, because many records do not identify a finder. Anthropic’s dashboard, as of Oct. 2, lists 6,157 vulnerabilities reported to maintainers, of which 516 were patched to the company’s knowledge. These are company-reported figures, not a complete measure of the state of all reported vulnerabilities.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
Why the Patch Gap Matters
More vulnerability disclosures give software makers and users a clearer record of known flaws, but a CVE entry is not the same as a working fix. The figures cited by Meyer suggest that discovery and repair are moving at different speeds: Anthropic says it reported thousands of vulnerabilities, while it knew of patches for only a fraction. That figure covers Anthropic’s reported set and should not be read as a patch rate for all CVEs.
The distinction matters because disclosed, unpatched flaws can leave systems exposed. At the same time, the source material does not show that the increase in CVEs has caused a corresponding rise in attacks. It says the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog grew less sharply than the CVE count, but the supplied material does not include the full comparison for 2026. Disclosure volume alone cannot establish real-world exploitation or measure the overall risk to users.
For security teams, the practical concern is workload: a larger list of disclosures can make it harder to identify which issues affect their systems and prioritize remediation. CVE counts also include records from major vendors and coordinators, so the total does not mean every organization faces the same increase in vulnerable products.
Popular right now
De'Longhi Linea Classic Espresso Machine with Adjustable Milk Frother
Samsung 42-Inch Class OLED S90F 4K Smart TV (2025)
Ninja Luxe Café Mini Plus Espresso and Drip Coffee Machine with AutoFroth, Stainless Steel, ES351
As an affiliate, we earn on qualifying purchases.
How the 2026 CVE Rise Was Measured
A CVE is a public identifier for a disclosed cybersecurity vulnerability. CVE Numbering Authorities, often vendors or other authorized organizations, assign identifiers and publish records as part of coordinated disclosure. As Meyer explains, an attacker who finds a flaw does not typically file a CVE; a record may instead reflect a vendor or researcher’s later disclosure and response. A CVE count measures published records, not the total number of bugs discovered or attacks underway.
Meyer counted records by publication date in the NVD’s CVE API and checked October records against CVE.org. The review reports daily averages of 267 in June 2026, 320 in July, 410 in August and 502 in September. For Oct. 1–25, it reports 557 records a day. The source says monthly daily rates rose 20% from June to July, 28% to August and 22% to September, with growth slowing to about 11% in October. Its estimate that October could finish near 17,000 is explicitly a projection, not a final count.
The review also says 98% of October records carry a 2026 identifier and that the median time from reserving an identifier to publication was 15 days. Those details are used to argue that the increase is not simply a backlog of older entries. They do not, on their own, identify the method used to discover a vulnerability or establish that AI caused the rise.
“The curve is still climbing fast, but the acceleration has slowed, not run away.”
— Thorsten Meyer, in the Oct. 26 review
What CVE Records Cannot Show
The central uncertainty is how much of the increase is attributable to AI. CVE records often omit the finder, and explicit AI attribution appears on only 200 of the 13,934 records in the review’s October count. That number cannot be treated as a complete tally of AI-assisted discovery, nor do the supplied figures establish that AI was responsible for the broader rise.
The source material also does not provide a full 2026 count for vulnerabilities added to CISA’s Known Exploited Vulnerabilities catalog, despite using that catalog as a measure of confirmed exploitation. It references 245 additions during 2025 but does not give the matching 2026 total. The relationship between rising disclosures and active attacks therefore remains unclear from the figures supplied.
Patch status is also incomplete. Anthropic says 516 of its 6,157 reported vulnerabilities were patched to its knowledge, but the source does not specify the status of every report or whether maintainers have acknowledged each one. The October count itself is not final, and the difference between the 13,934 figure for Oct. 1–25 and the 13,766 October total needs clarification.
Final Counts and Patch Updates
The October total can be checked against the final publication records once the month ends. Meyer’s estimate of about 17,000 records assumes the reported pace continues; it is a projection rather than a confirmed monthly result. Subsequent NVD and CVE.org records may also clarify the discrepancy between the review’s October figures.
Further reporting would help show whether the rise continues, which publishers account for it and how many records are tied to AI-assisted discovery. Updated patch information from maintainers and a comparable 2026 total from CISA’s exploited-vulnerability catalog would help readers judge whether the disclosure surge is being matched by remediation or active exploitation. For now, the available data confirms a steep rise in published CVEs, but leaves AI’s share and the full security impact unresolved.
Key Questions
How many CVE records were published in October 2026?
The review reports 13,934 records from Oct. 1 through 25. It separately says NVD and CVE.org agree on 13,766 October records, plus 202 later-rejected records; the source does not fully explain the difference.
Does the increase prove AI is finding most vulnerabilities?
No. The records do not reliably identify who found each flaw or what tools were used. Only 200 of the 13,934 records explicitly credited an AI lab or AI security firm, a figure the author says is incomplete.
What did Anthropic report about patching?
Anthropic’s dashboard listed 6,157 vulnerabilities reported to maintainers. The company said 516 were patched to its knowledge as of the review. Those figures apply to Anthropic’s reported set, not to all CVEs.
Does a higher CVE count mean more attacks are happening?
Not by itself. A CVE count tracks published vulnerability records, not confirmed exploitation. The review says CISA’s exploited-vulnerability catalog did not grow at the same pace, but the supplied material lacks a complete 2026 comparison.
Source: ThorstenMeyerAI.com
