🔍 Read the full analysis: CVE Trends In The AI Era: What The Data Reveals on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A source analysis of NVD and CVE.org data reports 13,934 CVE records published from October 1–25, 2026, and 88,772 so far this year. The increase is concentrated among several large vendors and numbering authorities, while disclosure records identify a finder in fewer than half of October cases. The data show more reported vulnerabilities, but do not establish how much AI contributed or how quickly most affected software will be patched.
Public vulnerability disclosures have risen sharply in 2026: an analysis of the U.S. National Vulnerability Database and CVE.org records found 13,934 CVEs published from October 1–25, compared with 4,389 in all of October 2025. The figures document a growing volume of disclosures, but the records do not show how much artificial intelligence contributed to finding the bugs or how many reported flaws have been fixed.
The analysis, published by Thorsten Meyer on October 26, counted records by publication date in the NVD CVE API and cross-checked October entries against CVE.org. It reports 88,772 CVE records so far in 2026, 78% more than the total for all of 2025. Its October figure covers the first 25 days, not a completed month. The author separately says the NVD and CVE.org October figures agree on 13,766 records, with 202 additional records later rejected; the source does not explain the difference between that count and the 13,934 figure used for the October 1–25 comparison.
The publication rate climbed through the summer, from 8,001 records in June to 9,919 in July, 12,719 in August and 15,074 in September, according to the analysis. The daily rate rose 20% from June to July, 28% from July to August and 22% from August to September. For October to the 25th, the author calculates that daily growth had slowed to about 11%. A projected October total near 17,000 is presented as an estimate based on the existing pace, not an observed final count.
The increase is not evenly distributed across software publishers and CVE numbering authorities. The analysis counts 1,455 Microsoft records in October, compared with 180 in October 2025, and 1,078 for Oracle, compared with 78 a year earlier. GitHub’s count rose from 276 to 1,159, while VulnCheck’s rose from 163 to 2,085. The Linux kernel count increased from 660 to 925. These counts describe published records; they do not by themselves establish that the software became less secure or that each record represents a newly discovered flaw.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
More Disclosures, Not a Measure of Attacks
A larger CVE count matters to security teams because every disclosure can add work: organizations must identify affected products, assess exposure, prioritize updates and apply fixes. But a publication surge is not the same as a surge in successful attacks. A CVE record documents a vulnerability disclosure, often coordinated by a vendor or another CVE Numbering Authority; it does not establish that attackers exploited the flaw or that AI found it.
The analysis points to the gap between discovery and remediation as a practical concern. Anthropic’s dashboard, as reported by Meyer, said the company had reported 6,157 vulnerabilities to maintainers; it knew of 516 that had been patched at the time of the dashboard figures. That is roughly one in twelve, but it is a company-reported status, not a complete independent accounting of fixes. The difference highlights why disclosure totals alone cannot tell software users whether risk is being reduced: the time until a fix is available and installed also matters.
For readers, the distinction is important. More disclosures may reflect more bugs being found, changes in how records are submitted, or a small number of high-volume publishers. The supplied data do not separate those effects fully. Nor do they show whether each unpatched issue is exploitable, affects a widely used product or presents the same level of risk.
Products Worth Considering
LG UltraGear 27G640A-B 27-Inch QHD IPS Gaming Monitor, 300Hz, 1ms, G-SYNC Compatible, FreeSync Premium, DisplayHDR 400
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
LG UltraGear 32GX870A-B 32-inch 4K OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the CVE Counts Were Built
Meyer says the monthly figures came from the NVD CVE API 2.0, using publication dates for all statuses, with the data retrieved on October 26, 2026, at 07:16 UTC. He cross-checked October records against CVE.org. The analysis reports that 98% of October records carried a 2026 identifier and that the median time between reserving an identifier and publication was 15 days. Those observations are offered to address whether the increase is mainly older records released late; they do not, on their own, establish why submissions increased.
CVE records are generally published through designated numbering authorities, often after coordinated disclosure. The entity publishing a record and the person or organization that first found the flaw are not necessarily the same. Meyer found that 6,346 of 13,934 October records, or 46%, named a finder. He counted 200 records, 1.4% of the total, that explicitly credited an AI lab or AI security firm. The author cautions that this is a floor, not a full measure, because records may omit discovery details or describe them inconsistently.
The analysis also cites Anthropic’s report that its Claude models had identified 29,439 candidate vulnerabilities. External firms reviewed 6,123 and confirmed 92.7% as real, according to the company; 6,157 had been reported to maintainers. Meyer says those findings were associated with 219 CVE records and 365 GitHub advisories at the time. OpenAI’s Patch the Planet program with Trail of Bits reported “hundreds of security issues” across 19 open-source projects, each reviewed by hand. These are program-reported figures and are not directly comparable with the total number of CVEs.
“That is a floor, not an estimate.”
— Thorsten Meyer, describing October CVE records
What the Records Cannot Establish
The available figures do not establish what share of the 2026 rise is due to AI-assisted discovery, expanded reporting, changes in publication practices or other factors. In October, 54% of records did not name a finder, according to Meyer’s count. Even explicit attribution can be incomplete, and the source says the 200 AI-related credits should be treated as a minimum rather than a full estimate.
The supplied source text also ends partway through its comparison with CISA’s Known Exploited Vulnerabilities catalog. It says the catalog added 245 entries during 2025, but provides no 2026 total or subsequent comparison. The material therefore does not support a conclusion about the current pace of confirmed exploitation relative to CVE publication. It also does not provide a complete, independently verified measure of patch status across all disclosures.
Several figures require careful interpretation: October is not yet complete, the projected monthly total is an estimate, and CVE counts may include records later rejected or otherwise updated. The analysis reports a difference between its 13,934 October 1–25 count and a cross-checked total of 13,766 plus 202 rejected records, without fully clarifying the counting categories. The final October total and the reason for that difference remain unresolved in the supplied material.
Final Counts and Patch Progress
The immediate next check is the completed October record count, including any later corrections or rejected entries, alongside a clear explanation of how each category is counted. Updated monthly data could show whether the October pace remained near the author’s estimate or changed before month-end. Comparisons should continue to name their time windows and baselines rather than treating a partial month as a final total.
Readers and security teams will also need more information on remediation: which disclosed flaws have fixes, when those fixes became available, and how widely they are deployed. Updated maintainer reports could clarify how Anthropic’s reported vulnerabilities progress from notification to patch. A full comparison with CISA’s exploitation catalog would help distinguish disclosure volume from publicly tracked known exploitation, though that catalog does not represent every attack.
For now, the analysis supports a measured conclusion: CVE publication has risen sharply, and several large publishers account for a substantial part of the reported increase. It does not quantify AI’s overall role or establish that exploitation is rising at the same rate. Those questions depend on better attribution, complete time-series data and evidence about fixes and exploitation.
Key Questions
How many CVEs were published in October 2026?
The analysis reports 13,934 records from October 1–25. It also cites a cross-check showing 13,766 October records plus 202 later rejected; the supplied material does not fully explain the difference in counting categories. October was not complete when the figures were gathered.
Does the increase show that AI found most of the vulnerabilities?
No. The records do not identify a finder in 54% of October cases. Meyer counted explicit AI lab or security-firm credits on 200 records, or 1.4%, but says that is a floor because attribution is incomplete. The data cannot establish AI’s overall share.
Does a higher CVE count mean more attacks are happening?
Not by itself. A CVE count tracks vulnerability disclosures, not confirmed exploitation. The source material does not provide a complete 2026 comparison with CISA’s Known Exploited Vulnerabilities catalog or evidence that attack activity rose in step with disclosures.
How many vulnerabilities reported by Anthropic were patched?
Anthropic’s dashboard, as cited in the analysis, said 516 of the 6,157 vulnerabilities it reported to maintainers were patched to the company’s knowledge. That is a company-reported snapshot, not a complete independent tally of all fixes.
What should readers watch for next?
Watch for the final October CVE count and any clarification of the reported count difference, as well as updated information on patches and known exploitation. Those measures can help distinguish a rise in disclosures from changes in real-world risk.
Source: ThorstenMeyerAI.com
