🔍 Read the full analysis: The Numbers Behind CVEs, AI, And The Growing Fix Gap on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A review of NVD and CVE.org data counted 13,934 new CVE records published from Oct. 1–25, 2026, about 3.2 times the total for October 2025. The figures do not show how much AI contributed to finding bugs, and Anthropic says just 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge.
A review of NVD and CVE.org records counted 13,934 new CVEs published from Oct. 1–25, 2026, about 3.2 times the 4,389 records published during all of October 2025. The rise in disclosed vulnerabilities is not a measure of AI’s contribution or of successful attacks, while data reported by Anthropic points to a separate concern: the pace of fixing flaws may lag behind their discovery.
The review queried the National Vulnerability Database’s CVE API and cross-checked October entries against CVE.org. It reports 13,766 records published in October, plus 202 later rejected; its broader count of 13,934 covers the period through Oct. 25. The author says 98% of the October records had 2026 CVE identifiers and the median time between reserving an identifier and publication was 15 days.
The published daily rate rose from 267 records in June to 320 in July, 410 in August and 502 in September. For Oct. 1–25, the average was 557 per day. The review says the month-to-month rate of growth slowed: it estimates an 11% increase for October, compared with 20% to 28% in the preceding monthly steps. An estimate of roughly 17,000 records for October is a projection, not a final count.
The increase was uneven across publishers. Microsoft had 1,455 records in October, compared with 180 in October 2025; Oracle had 1,078, compared with 78. GitHub rose from 276 to 1,159, and VulnCheck from 163 to 2,085. The Linux kernel count rose from 660 to 925. The review attributes much of the overall increase to a handful of vendors and vulnerability coordination organizations, rather than a uniform rise across all software.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
More Disclosures, More Unpatched Bugs
A higher CVE count means more vulnerabilities are being formally recorded, but it does not by itself show that software is less secure, that attacks have increased at the same rate, or that AI caused the change. A CVE is a disclosure record; it can cover a flaw in existing software that defenders have recently found and reported.
The practical concern is whether maintainers and users can respond. Anthropic’s dashboard, as described in the review, lists 6,157 vulnerabilities reported to maintainers and 516 patched to the company’s knowledge, roughly one in twelve. That is a company-reported figure, not a complete independent audit of patch status. Still, it illustrates why publication totals alone cannot tell readers whether exposure has been reduced: disclosure must be followed by a fix and its adoption.
For organizations responsible for software, the numbers reinforce the need to track affected products, assess exposure and apply available fixes. For readers, they are a reason to distinguish the count of reported flaws from evidence that a specific vulnerability is being exploited.
Products Worth Considering
DJI Osmo Mobile 7P with Mic Mini TX (Infinity Black) Gimbal Stabilizer
DJI Osmo Mobile 8 Phone Gimbal with Mic Mini Transmitter, Infinity Black
DJI Osmo Mobile 8 Standard Combo Phone Gimbal Stabilizer
As an affiliate, we earn on qualifying purchases.
What the CVE Records Can Show
Common Vulnerabilities and Exposures identifiers give publicly disclosed security issues a shared reference number. A CVE record is usually coordinated through a CVE Numbering Authority, often a vendor, and does not necessarily identify who first discovered the flaw. The review argues that criminal finders do not file CVEs; records generally reflect a defender’s disclosure process, even when a vulnerability had already been exploited.
That distinction matters for interpreting the claim that AI is behind the surge. Of the 13,934 October records, the review found 6,346 named a finder; it says 200 explicitly credited an AI lab, AI model or AI security firm. The author cautions that this is a floor because many records do not name a finder. The counts therefore cannot establish what share of all discoveries involved AI.
Anthropic’s dashboard, as reported in the source, lists 29,439 candidate vulnerabilities found by Claude models. External firms reviewed 6,123 and confirmed 92.7% as real, while 6,157 had been reported to maintainers. Those company figures describe different stages of its process and should not be treated as equivalent to CVE totals. OpenAI’s Patch the Planet program with Trail of Bits has reported hundreds of security issues across 19 open-source projects, with findings reviewed by people, according to the source.
“going parabolic”
— David Shapiro podcast host, as quoted by Thorsten Meyer
The record data does not settle how many flaws were found with AI assistance. More than half of October entries in the review did not name a finder, and a named reporter is not necessarily the original discoverer. The 1.4% explicitly linked to AI is therefore not a reliable estimate of AI’s total role.
Nor does the material establish that the CVE surge has produced a comparable increase in successful attacks. The source says the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog added 245 entries in all of 2025, but the supplied material ends before giving a comparable 2026 figure. It also provides no complete, independently verified count of how many reported flaws have been patched or how quickly patches are reaching users.
The totals require care: the source gives both 13,934 records for Oct. 1–25 and 13,766 published in October plus 202 later rejected. These figures refer to different record-status treatments. The final October count may change as records are added, revised or rejected.
Final Counts and Fix Tracking
The October publication total should be treated as provisional until the month ends and records are reconciled for status changes. A useful follow-up will compare final monthly data on the same basis and examine whether the increase remains concentrated among a small number of vendors and coordinators.
For the fix gap, the key next step is clearer, comparable reporting on remediation: which disclosed vulnerabilities have patches, when those patches were released and whether affected users have applied them. The supplied material does not give a timetable for Anthropic to update its dashboard or a complete 2026 total for CISA’s exploited-vulnerability catalog, so those measures remain open.
Key Questions
How many CVEs were published from Oct. 1–25, 2026?
The review counted 13,934 records for that period. It separately reports 13,766 published October records plus 202 later rejected, reflecting a difference in record status and counting scope.
Does the increase prove AI is finding most vulnerabilities?
No. The review found explicit AI-related credit in 200 October records, but 54% named no finder. The data cannot establish AI’s full contribution.
How many vulnerabilities reported by Anthropic were patched?
Anthropic’s dashboard listed 516 patched out of 6,157 vulnerabilities reported to maintainers, according to the source review. The company said this was the number patched to its knowledge.
Do more CVE records mean more attacks?
Not on their own. CVE publication counts measure disclosed records, not attacks. The supplied source does not provide a comparable 2026 total for CISA’s Known Exploited Vulnerabilities catalog.
Source: ThorstenMeyerAI.com
