🔍 Read the full analysis: What The CVE Numbers Say About Security Research In The AI Era on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A source analysis of US vulnerability records found 13,934 new CVE records published from Oct. 1-25, 2026, more than three times the total for all of October 2025. The records show a sharp increase in disclosures, but often do not identify who discovered a flaw or whether AI was used. The analysis also points to a gap between reported vulnerabilities and fixes; its figures do not establish how much AI caused the surge or how many flaws are exploitable.
A review of 13,934 CVE records published from Oct. 1-25, 2026, found that the month’s disclosures had already reached 3.2 times the October 2025 total, raising questions about the speed of software vulnerability discovery and repair. The figures show a steep increase in public records, but they do not establish how much artificial intelligence contributed: 54% did not name a finder, and 1.4% explicitly credited an AI lab or security firm.
The analysis, published by ThorstenMeyerAI.com on Oct. 26, says it queried the US National Vulnerability Database’s CVE API for records by publication date and cross-checked October entries against CVE.org. It counted 13,934 records from Oct. 1-25, compared with 4,389 for all of October 2025. The NVD and CVE.org counts were reported to agree on 13,766 October records, with another 202 later rejected; the analysis’s 13,934 figure includes the period’s published records before that distinction.
The pace is high, but the analysis cautions against describing the trend as “parabolic.” It reports daily averages rising from 267 records in June to 320 in July, 410 in August and 502 in September. For Oct. 1-25, the reported average was 557 per day. The month’s increase in daily volume was about 11%, below the reported monthly growth rates from June through September. A projection that October might end near 17,000 records was the author’s estimate, not a final count.
Disclosures were concentrated among a small number of large organizations. Microsoft was listed on 1,455 records for October, up from 180 in October 2025; Oracle rose from 78 to 1,078, and GitHub from 276 to 1,159, according to the analysis. It says many records did not identify an individual or organization as the finder, so the organizations publishing or numbering CVEs should not automatically be treated as the original discoverers.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
More Disclosures, Same Repair Challenge
A CVE record makes information about a vulnerability easier for vendors, security teams and researchers to track. A larger volume can indicate that more flaws are being found or disclosed, but a count alone does not show how severe the flaws are, whether they are being exploited, or whether the underlying software has been fixed. Those distinctions matter to organizations deciding which issues need attention first.
The analysis highlights a possible gap between discovery and remediation. Anthropic’s disclosure dashboard, as quoted in the report, listed 6,157 vulnerabilities reported to maintainers and 516 patched to the company’s knowledge. That is roughly one in twelve, but it is a company-reported figure, not an independent measure of every vulnerability’s status. The report’s central concern is that finding more flaws does not by itself reduce risk if maintainers cannot review and patch them promptly.
For readers and security teams, the numbers are a signal to look beyond the headline total. Record volume, known exploitation, severity, affected products and patch availability measure different parts of the problem. The available data supports a rise in published disclosures; it does not, on its own, show a comparable rise in attacks or prove that AI is the primary cause.
Products Worth Considering
HP Sprocket Panorama Portable Color Photo and Label Printer
Apple Mac mini Desktop Computer with M5 Pro Chip (2026)
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER)
As an affiliate, we earn on qualifying purchases.
How CVE Records Are Counted
CVE is a system for identifying publicly disclosed vulnerabilities. Records are generally assigned and published through authorized numbering organizations, often after a vendor or maintainer has prepared a disclosure. That means a CVE count tracks published records, not every flaw discovered privately, every security incident, or every attempted attack. The report says a record may reflect a defender’s disclosure even when the vulnerability was first found or exploited by someone else.
The October analysis counted by the date a record was published, using NVD API data from January 2022 onward and checking October against CVE.org. It reported that 98% of October records carried a 2026 CVE ID and that the median interval from ID reservation to publication was 15 days. Those measures suggest the October total was largely made up of recently numbered entries, rather than only older records released at once; they do not explain why the volume rose.
The report also cites separate AI-security initiatives. Anthropic’s dashboard, as of Oct. 2, listed 29,439 candidate vulnerabilities identified by Claude models; external firms had reviewed 6,123 and confirmed 92.7% as real, according to the company. Anthropic said 6,157 had been reported to maintainers. OpenAI’s Patch the Planet program with Trail of Bits reported “hundreds of security issues” across 19 open-source projects, with manual review. These company figures use different methods and should not be read as a direct count of CVEs.
The records do not settle how much AI contributed to the rise. Of the 13,934 October entries, the analysis says 6,346 named a finder, while 200 explicitly credited an AI lab, model or AI security firm. Because most records lacked finder information, the 1.4% figure is only the share with explicit credit, not a reliable estimate of all AI-assisted discovery. Nor does the data show whether an AI tool found a flaw, helped validate it, or played no part.
The source also cites claims that attackers are using inexpensive AI agents against older vulnerabilities and that a Chinese open-weight model can build exploits with weak safeguards. Those statements are attributed to the report’s references to NorForge, Reuters and Anthropic; the supplied material does not provide enough detail to independently assess the methods, scale or outcomes. It is also unclear how many October CVEs are exploitable, how quickly maintainers will fix them, or whether the month’s unusually high volume will continue.
The analysis compares CVE publication with CISA’s Known Exploited Vulnerabilities catalog, saying that catalog added 245 entries in all of 2025 and did not grow at the same pace as the CVE count. The supplied source ends before giving the comparable 2026 figures, so it cannot establish the current-year trend or support a full comparison between disclosures and confirmed exploitation.
Track Fixes and Exploitation
The next useful checks are the final October CVE total, subsequent updates to CISA’s Known Exploited Vulnerabilities catalog, and whether maintainers confirm additional patches for reported flaws. Those measures can help distinguish a jump in disclosure volume from changes in real-world exploitation or remediation.
More complete finder attribution would also improve future analysis of AI’s role. Until records routinely capture whether AI assisted discovery and how that assistance was used, public CVE counts can show the volume and timing of published vulnerabilities but cannot assign the increase to AI. The Oct. 26 report offers a snapshot through Oct. 25, not a final account of the month or a forecast of what comes next.
Key Questions
How many CVE records were published in October 2026?
The analysis counted 13,934 records from Oct. 1-25. It separately reports 13,766 October records in the NVD and CVE.org cross-check, plus 202 later rejected. The figures reflect different record-status treatment, so they should not be treated as a final full-month total.
Does the increase prove AI found most of the vulnerabilities?
No. The report says only 200 records, or 1.4%, explicitly credited an AI lab or security firm, while 54% named no finder. The missing attribution means that percentage cannot measure AI’s full contribution.
Does a CVE record mean a vulnerability is being exploited?
No. A CVE record identifies a disclosed vulnerability; it does not by itself show that attackers are using it. The report treats CISA’s Known Exploited Vulnerabilities catalog as a separate measure, and the supplied material does not provide complete comparable 2026 figures.
How many vulnerabilities reported by Anthropic had been patched?
Anthropic’s dashboard, as cited in the report, said 516 of 6,157 vulnerabilities reported to maintainers had been patched to the company’s knowledge. That is a company-reported status and may not capture every later fix.
Will the high CVE count continue?
That is not yet clear. The report projected that October could finish near 17,000 if its pace held, but that was an estimate made before the month ended, not a confirmed total or a prediction supported by a longer-term forecast.
Source: ThorstenMeyerAI.com
