cvegen

october 2026

cves so far
13,601
days in the data
24 of 31
busiest day
oct 13, 2,291
used in real attacks
14 so far

redrawn with every new snapshot until the month ends. last drawn oct 24.

october 2026 has brought 13,601 cves in its first 24 days, 4.4 times what the same days brought in 2025.

every one of its first 24 days ran above the 2025 average for that weekday.

2,291

on oct 13, the busiest day so far. microsoft published 1,407 of them at once.

1,173

rated critical, cvss 9 or higher. 832 of them can be hit over the network with no login and nothing for a user to click.

752

in browsers, 22 times their 2025 pace. no other kind of software grew as fast.

2,918

came in three single drops: microsoft 1,407 on oct 13, oracle 1,076 on oct 20, the linux kernel team 435 on oct 18.

14 used in real attacks so far

cisa kev, as of oct 24

  • 2
    ahsaycbs
    oct 4
  • 1
    fortinet fortimail
    oct 1
  • 1
    citrix netscaler
    oct 4
  • 1
    atlassian products
    oct 5
  • 1
    ivanti connect secure
    oct 13
  • 1
    microsoft windows
    oct 13
  • 1
    cisco secure email gateway
    oct 14
  • 1
    collabora online – built-in code server
    oct 14
  • 1
    eg secure solutions siteguard server edition
    oct 14
  • 1
    palo alto networks pan-os
    oct 14
and 3 more productsall 14 with cve ids

cisa keeps adding older cves when attacks come to light, so this list can still grow.

this poster

period
october 1 to 24, 2026
cves
13,601
data
cve list v5, cisa kev, drawn 2026-10-24
format
3:4, drawn for 45 × 60 cm
download jpg, 2000 × 2667