🔍 Read the full analysis: How To Make Sense Of Rising CVEs And The AI Patch Gap on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
ThorstenMeyerAI.com reports 13,934 new CVE records were published from Oct. 1 through Oct. 25, 2026, with much of the increase concentrated among a few vendors and vulnerability coordinators. The analysis says AI is contributing to discovery, but incomplete finder data and a low reported patch count make it difficult to measure AI’s role or how quickly fixes are reaching users.
An analysis published Oct. 26 by ThorstenMeyerAI.com counted 13,934 new CVE records published from Oct. 1 through Oct. 25, 2026, and found that the increase was concentrated among a small number of vendors and coordinators. The figures describe vulnerability disclosures, not confirmed attacks; the analysis says the more immediate operational concern is whether maintainers can patch reported flaws quickly.
The analysis queried the U.S. National Vulnerability Database’s CVE API and cross-checked October records against CVE.org. It reports 13,766 records published in October at the time of its count, plus 202 records later rejected, for 13,934 records in the stated Oct. 1–25 total. The article’s table gives the period’s publication rate as 557 records per day. It also says 98% of October records had a 2026 CVE identifier, while the median time between reserving an identifier and publishing a record was 15 days.
The increase was not evenly distributed. Microsoft accounted for 1,455 October records, compared with 180 in October 2025; Oracle rose from 78 to 1,078, and VulnCheck from 163 to 2,085. The analysis says most Oracle records appeared on Oct. 20. These counts reflect records associated with organizations in the CVE data; they do not, by themselves, establish how many independent software flaws were found or how many were exploitable in real-world systems.
The source also highlights a gap between reported discoveries and documented fixes. Anthropic’s disclosure dashboard, as described in the analysis and dated Oct. 2, listed 6,157 vulnerabilities reported to maintainers and 516 patched to Anthropic’s knowledge. That is the company’s reported status, not a complete measure of all fixes across software projects. The analysis says AI tools are part of vulnerability research, but the public CVE records do not identify the finder for most entries.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
Why Patch Speed Matters
A rising number of published CVEs can help defenders learn about flaws and prioritize updates, but publication alone does not protect systems. Organizations need to determine whether affected software is in use, assess exposure, and apply available fixes. Where a vulnerability has been disclosed but not patched, defenders may have limited options beyond mitigations such as restricting access or disabling affected components.
The analysis’s figures point to a discovery-to-remediation gap, while leaving its full scale uncertain. Anthropic’s reported count of 516 patches among 6,157 disclosures is a snapshot based on the company’s knowledge, not an independently verified, industry-wide patch rate. Still, it illustrates why faster discovery can add pressure to maintainers and security teams if review, coordination, and deployment do not keep pace.
For readers responsible for software, the practical takeaway is not to treat a large CVE total as a direct measure of immediate danger. A CVE record does not prove that a flaw is being exploited or that every installation is vulnerable. Teams need to check vendor advisories, affected versions, available updates, and credible exploitation information.
Products Worth Considering
Apple iPad Air (2025) 13‑inch Wi‑Fi 256 GB – Space Gray (M3 chip)
Apple iPad Air 13-inch (M4), 128GB, Wi-Fi 7, Space Gray
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
As an affiliate, we earn on qualifying purchases.
What the CVE Counts Show
A CVE is a public identifier and record for a disclosed vulnerability. CVE records are published through a network of authorized numbering authorities, often after a vendor or maintainer has coordinated a disclosure. The source argues that this process makes the publication surge a measure of disclosed and cataloged vulnerabilities, not a count of bugs found by attackers. That distinction matters: criminal exploitation is not measured by simply counting CVEs.
The article compares the October 1–25 total of 13,934 records with 4,389 records for all of October 2025, describing the partial-month 2026 count as 3.2 times the prior October total. It also reports 88,772 records for 2026 through the date of collection, 78% more than in all of 2025. These comparisons use different time windows, so the full-year totals should not be read as a like-for-like annual rate.
The source says daily publication rates increased 20% from June to July, 28% from July to August, and 22% from August to September. For October through the 25th, it estimates an increase of about 11% from September. Its estimate that October could finish near 17,000 records is explicitly a projection, based on the pace holding, rather than a final count.
“6,157 vulnerabilities have been reported to maintainers.”
— Anthropic, as reported in its disclosure dashboard and summarized by ThorstenMeyerAI.com
What the Records Cannot Establish
The analysis says 6,346 of 13,934 October records named a finder, leaving 54% without one. It counted 200 records, or 1.4%, that explicitly credited an AI lab or AI security firm as a finder, reporter, or tool. The source calls that a floor, because records may omit or describe contributors inconsistently. Those data cannot establish what share of vulnerabilities AI systems helped discover.
Nor does the CVE count show how many disclosed flaws are being exploited, how many affect widely used installations, or how quickly organizations are deploying fixes. The supplied source says CISA’s Known Exploited Vulnerabilities catalog grew less sharply than CVE publications and added 245 entries during 2025, but it provides no complete 2026 comparison in the material available here. It is not possible from that information to quantify current exploitation trends against the 2026 disclosure surge.
The 516 patched figure is also limited to vulnerabilities Anthropic says it knows have been patched. The source does not provide a full breakdown by software, severity, date of report, or maintainer, nor an independent check of each patch’s availability and adoption. Its October figures and any month-end projection remain subject to revision.
Tracking Disclosures and Fixes
The immediate next step is to track final October CVE totals and compare them with subsequent monthly data using consistent date ranges. Security teams should follow affected vendors and maintainers for advisories, corrected versions, and interim mitigations, while checking trusted sources for evidence of exploitation. A published CVE should prompt assessment, not be treated as proof that a system has been attacked.
To judge whether AI is changing security outcomes, future reporting will need clearer information on how flaws were found, how quickly they were reported and fixed, and whether exploitation followed disclosure. The figures cited here establish a notable rise in published records and a limited snapshot of patches known to one research effort. They do not yet establish the overall effect of AI on attacker capability or the security of deployed software.
Key Questions
How many CVE records were published from Oct. 1 through Oct. 25, 2026?
ThorstenMeyerAI.com reports 13,934 records for that period, based on NVD data cross-checked against CVE.org. The source separately says 13,766 records were published in October at the time of its count, with 202 records later rejected.
Does the CVE increase mean attacks increased at the same rate?
No. CVE publication counts track disclosed vulnerability records, not attacks. The supplied analysis does not provide a comparable 2026 exploitation total that would show attacks rising at the same rate.
How many vulnerabilities reported by Anthropic were patched?
Anthropic’s dashboard, as summarized in the source and dated Oct. 2, listed 516 patched to its knowledge out of 6,157 vulnerabilities reported to maintainers. The source does not describe this as a complete or independently verified patch count.
Can the records show how much AI contributed to vulnerability discovery?
Not reliably. The analysis says 54% of October records named no finder, and 1.4% explicitly credited an AI lab or security firm. The latter is a documented minimum in the records, not an estimate of AI’s full contribution.
Source: ThorstenMeyerAI.com
