The 2026 CVE count is not a rendering glitch: the NVD feed shows about 88,700 CVEs from January 1 to October 29, 2026, against about 39,300 in the same window of 2025, roughly 2.3x. A chart from the CVE tracker at cve.0xosprey.com went viral this week, posted by @mansantillan with the caption "We are not worried enough about what's coming." The line is flat for two decades, then goes nearly vertical: roughly 15,000 CVEs in the latest full month, with a dotted projection toward 17,000 or more.
The honest reading is more useful than the scary one. The surge is real, part of it is bookkeeping, and the share that gets exploited is tiny. What changed is how hard it has become to know which few matter to you.
TL;DR
| Question | Answer |
|---|---|
| How big is the jump? | About 88,700 CVEs by Oct 29, 2026 vs 48,151 for all of 2025 |
| Peak month? | September 2026, about 15,000 (sources give 14,900 to 15,074) |
| Is it all AI? | No. AI is a likely major driver, but counting and assignment changes matter too |
| How many are exploited? | About 0.23% of 2026 CVEs, per Google's threat intelligence group |
| What broke? | NVD enrichment: 87.1% in 2025 to 8.4% in Q3 2026 in one analysis |
| What should I do? | Triage by KEV, then EPSS, then exposure; patch your agents first |
What the chart actually shows
Monthly figures from Cyber Strategy Institute's October 2026 analysis, as of its September 30 snapshot:
| Month | CVEs published |
|---|---|
| April | 5,602 |
| May | 7,262 |
| June | 7,765 |
| July | 10,155 |
| August | 12,719 |
| September | 15,066 |
That analysis puts Q3 at 37,940 CVEs in 92 days, about half of everything published in 2026 so far, and 2026 year to date at 75,242 by the end of September. The Iru "Black October" write-up, using NVD data through October 29, puts the year at about 88,700 and notes September averaged one new CVE every 2.9 minutes. Two independent counts, 86,292 through October 23 and 86,533 through October 25, land in the same range.
Treat the last point on any tracker as provisional. October numbers were partial when these analyses were written, and the dotted projection in the chart is the author's estimate, not data. The Cyber Strategy Institute piece also notes October began with a roughly nine-day publication freeze, ended by a record Patch Tuesday: Microsoft's October release of 1,411 flaws accounts for a large single-day spike.
Why the CVE count is spiking
No one can yet apportion the rise. The credible drivers, with what each source actually supports:
- AI-assisted discovery. CyberHire counted 769 CVEs crediting an AI system, up from 34, a 22x rise, but still under 1% of all 2026 CVEs. That is a floor: many finders do not credit their tools. Beam has covered the offensive side in Mythos 5.2's 89.6% CVE rediscovery score and OpenAI's pipeline that built 948 Linux privilege escalation exploits.
- Automated assignment. Google estimates about 5,000 Linux kernel CVEs came from automated assignment through August. CVE Numbering Authorities also grew from 484 to 559.
- A change in the unit being counted. Cyber Strategy Institute argues a June 2026 one-flaw-one-ID rule ("anti-bundling") changed what a CVE represents, and calls September's record "substantially" an accounting artifact stacked on a real increase.
- Genuine growth beyond all that. Excluding the Linux kernel, large WordPress issuers and VulDB, volume still roughly tripled, from 20,242 to 61,970 per the Iru analysis.
The defensible summary: volume is up for real, the exact multiple depends on how you count, and the AI share is not isolatable from public data. Vendors also rarely name finders, and the rise started before the largest AI bug-finding programs launched.
The number that matters more: how few get exploited
Raw volume is a poor proxy for risk. Per the same sources:
- About 0.23% of 2026 CVEs are known exploited (Google; 183 of 77,944 scored CVEs as of October 22 in one match).
- CISA KEV added 278 entries through October 28, versus 212 in the same window of 2025, about 31% more.
- KEV additions per 1,000 new CVEs fell from about 6.5 in 2023 to about 3.1 in 2026.
So the exploited set grew modestly while the haystack more than doubled. This is why the November 2026 attacks timeline tracks exploited and KEV-listed flaws separately from the general CVE flood: the needle count is what drives incident response.
The real problem: NVD stopped scoring most of them
The scarier chart is not CVE count but verified severity. One analysis reports NVD enrichment coverage dropping from 87.1% in 2025 to 8.4% in Q3 2026, leaving about 54,390 unenriched 2026 CVEs. That is a single analyst's figure, so verify against NVD before quoting it, but the direction is consistent with other reports of a growing "Awaiting Analysis" queue.
Any workflow of "patch everything CVSS 8.0 and above" quietly fails when most new CVEs have no CVSS from NVD. The Cyber Strategy Institute piece reframes the control question: not "did we patch everything scored 8.0+?" but "can we show which unrated flaws touch us, and who decided they could wait?"
How to triage when there are this many CVEs
A workable order, using signals that exist even for unscored CVEs:
- Is it in CISA KEV? Exploited in the wild. Patch or mitigate first.
- What is the EPSS score? In that analysis, only about 490 unenriched CVEs had EPSS of 0.50 or higher and about 2,070 had 0.10 or higher: a manageable queue once sorted.
- Is the affected software actually deployed? Inventory beats severity. Most CVEs are not in anything you run.
- Is it reachable? Internet-facing, auth-bypass and RCE classes first; local-only bugs after.
- Record the decision. For unrated flaws you defer, write down who decided and why.
If you are patching manually, start with the tools that run with your credentials every day.
What this means if you run AI coding agents
Coding agents are both a cause of the CVE surge and a target of it. They find bugs, and they ship in the same category of software that gets CVEs: a terminal agent with shell access, your tokens and your repo is a high-value local target. Recent examples Beam has covered include a Claude Code Edit tool race on macOS and the wider set in October's AI-led attacks roundup.
Practical habits:
- Keep agents on a fast update path. Run
claude --versionor your agent's equivalent regularly; agent harnesses patch more often than OS software. - Assume attacker-controlled repos. A flood of CVEs means a flood of exploit attempts against dependencies. Treat unknown repos like untrusted CI input.
- Review MCP servers and skills before connecting them. See MCP server security review for what an offline scan can and cannot prove.
- Put hard limits in the harness, not a policy document. Stopping dangerous Claude Code commands walks through permission rules and PreToolUse hooks.
- Use AI on the defensive side too. Trail of Bits' regression-hunt and patching-bugs plugins are an example of agent skills pointed at fixing, not finding.
What Beam can and cannot do here
Beam does not scan your machine for vulnerable packages, patch software or replace a vulnerability management program. It is local, privacy-first observability for AI coding agents: it records what Claude Code, Codex and similar agents propose to run, flags risky actions such as credential exposure and destructive commands, and scans skills and MCP configs against heuristic patterns before you run them. On Claude Code and Codex, matched calls can be denied through PreToolUse hooks when workspace policy is in enforce mode.
The limits are real. Hook-based deny is not a kernel sandbox, a missing or expired cached policy is fail-open, and scanning is heuristic rather than semantic. Beam reduces what an agent can be steered into doing on a compromised or malicious project; it does not close the CVE in the agent itself. Patching remains the fix.
Hy4's November 2026 CWE-Bench-AA lead is covered in our Tencent Hy4 open-weight safety post—benchmark patching skill is not the same as locking down your laptop.
Related reading
- Microsoft's record 1,411-flaw Patch Tuesday
- Mythos 5.2 and CVE rediscovery
- Open-weight model builds Firefox exploits from unshipped fixes
- OpenAI's 948 Linux privilege escalation exploits
- November 2026 attacks timeline
- CVE-2026-122006: Rails Active Storage ImageMagick
- CVE-2026-114713: UnrealIRCd label injection on CISA KEV (Nov 13)
- CVE-2026-123039: Check Point DynamicCLI escalation on CISA KEV
- Beam landing: what gets watched
Sources
- CVE Tracker chart and the post by @mansantillan
- Iru: Black October, the haystack doubled
- Cyber Strategy Institute: The Count Broke First, CVE volume in 2026
- NVD and CISA KEV catalog for current counts
Frequently asked questions
Why are there so many CVEs in 2026?
Several causes stack. AI-assisted bug finding is a likely major driver, CVE Numbering Authorities grew from 484 to 559, automated assignment such as the Linux kernel added about 5,000 CVEs through August per Google, and a June 2026 one-flaw-one-ID rule changed the unit being counted. Nobody can yet say how much of the rise is each factor.
How many CVEs have been published in 2026?
About 88,700 through October 29, 2026 according to an analysis of the NVD feed, versus about 39,300 in the same window of 2025 and 48,151 for all of 2025. Independent counts of 86,292 (through Oct 23) and 86,533 (through Oct 25) are in the same range. Check the NVD dashboard for the exact current figure.
Does more CVEs mean we are less secure?
Not by itself. The count measures the disclosure system as much as the software. About 0.23% of 2026 CVEs are known exploited per Google threat intelligence, and CISA KEV additions per 1,000 new CVEs fell from about 6.5 in 2023 to about 3.1 in 2026. The practical risk is triage failure, not the raw number.
What is the NVD enrichment backlog?
NVD has not scored or analyzed most new CVEs. One analysis reports enrichment falling from 87.1% in 2025 to 8.4% in Q3 2026, leaving roughly 54,390 unenriched 2026 CVEs. It is a single analyst figure, so verify against NVD directly, but the direction is consistent across sources.
How should I prioritize with this many CVEs?
Sort by CISA KEV membership first, then EPSS probability, then whether the affected software is actually installed in your environment. Do not rely on CVSS alone, since many 2026 CVEs have no NVD severity score yet.
Does Beam stop vulnerable software from running?
No. Beam does not patch or inventory vulnerabilities. It watches what AI coding agents do on your machine and can deny matched risky tool calls through Claude Code and Codex PreToolUse hooks when workspace policy is in enforce mode. It reduces what an agent can be tricked into doing, but patching your agent and dependencies is still on you.