A record week for CVEs, and what the numbers don't tell you

5,460 CVEs were published in the week of 12 to 18 October. That's a new weekly record and about 70% up on the week before, when 3,212 came out. Add the advisories that don't have a CVE and the total of publicly reported vulnerabilities was 5,487, also a record.

Last week in numbers

• 5,487 unique vulnerabilities, up 2,243 on the week before.
• 5,460 of them were CVEs.
• 382 were rated critical, 2,323 high, 2,105 medium and 155 low. Another 495 hadn't been scored yet.
• 27 were advisories with no CVE, from sources like GitHub, PyPI, Go and RustSec.

The longer trend

One week can be noisy, so I pay more attention to the averages. The 12-week average now sits at 3,247 unique vulnerabilities a week. A year ago it was 924.

Over the last 52 weeks the average was 1,811 a week. From January 2020 to November 2022 it was 427 a week. That's more than four times the old baseline.

So far this year there have been 83,741 unique vulnerabilities, up 118.5% on the 38,330 at the same point last year.

Where AI shows up

Vulnerabilities that mention AI reached 532 in September 2026, up from 104 a year earlier. Most of those, 484, relate to LLMs, generative AI and agent tooling, and 48 relate to ML frameworks. Over the last 12 months there were 3,152 of them, about 3.6% of everything reported.

There's a second number I find more interesting. This year 218 CVEs say outright that the bug was found with AI help, and 51 of those came in September. At the same point last year there were none. That only counts the ones that say so, so it's a floor, not a total.

"AI-related" here is a keyword match on descriptions and product names, so expect some false positives and some misses.

Careful with cause and effect

These counts show what got reported, not why. More researchers, better tooling, AI-assisted discovery and a lot more AI software to break are all mixed in together, and the data can't separate them. Recent weeks can also rise a little as late records land, and severity scores shift as NVD, vendors and CISA catch up.

What I can say is that the volume is real either way. Patch queues are getting longer every week. If your team still triages vulnerabilities by hand, one at a time, that's worth rethinking. Prioritise by what you actually run and what's exposed, and lean on automation for the rest.

Sources

The data comes from the CVE Program's cvelistV5, NVD, OSV.dev (including the GitHub Advisory Database, PyPI, Go, RustSec and OSS-Fuzz), Exploit-DB and Metasploit. It covers ISO weeks starting Monday, with data through 18 October 2026 (UTC).