Monthly review published November 1, 2026, covering October 2026; counts attributed to the review author and the named sources
October by the Numbers: 17,060 New CVE Records, 36 KEV Additions, and One Theft Behind Almost All Crypto Losses
A monthly review published November 1 counts October 2026 as a record month on three separate ledgers that measure different things. On disclosure, by the review author count from the National Vulnerability Database API queried on November 1, 17,060 new CVE records were published in October, excluding rejected records, up from 4,273 in October 2025 and 3,564 in October 2024; including rejected records would raise the October figure to 17,481. The January to October total for 2026 stands at 89,859 records on the same count, against 39,639 in the same period of 2025. On confirmed exploitation, the increase is far smaller: CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, against 31 in October 2025 and 17 in October 2024, bringing the 2026 year-to-date total to 282 by October 30, already above the 245 additions for all of 2025. Five October KEV additions involved older flaws first published between 2015 and 2023. On losses, CertiK figures cited by the review put October crypto losses at $3.47 billion after frozen and returned funds, against $68 million in October 2025, with the Binance theft accounting for 96.7 percent of the October total. The review is explicit about what the numbers cannot prove: a CVE record documents a disclosed flaw, not an attack, the count depends on assignment and publication practices, and the AI-linked research it documents, including at least 65 Microsoft October entries crediting AI tools or firms by its count, does not establish that AI caused the wider increase. All headline figures in this story are the review author counts and the cited sources figures, presented as reported, not as independently verified totals.
Executives
Read the three ledgers separately, because they argue for different decisions. Disclosure quadrupled, which mostly measures how much is being found and published. Confirmed exploitation rose modestly, 36 KEV additions, and that short list is where patching urgency actually lives. Losses spiked because of one incident at one exchange, which is a concentration lesson, not a sector trend. A board that merges these into one scary number will misallocate the next quarter budget; a board that separates them knows to fund KEV-driven patching speed and vendor concentration review.
CIO / CISO
Use the ratio as a prioritization argument inside your own program: 36 exploited flaws against 17,060 disclosures is the standing case for KEV-first sequencing, with edge devices, remote access gateways and developer platforms at the front, which is where October additions clustered. Track your own mean time to remediate KEV items against their federal due dates as the metric that matters, and treat disclosure volume as a scanning and triage capacity question rather than a patching mandate.
Engineers
Expect scanner noise to keep rising with disclosure volume: deduplicate by product and exploitability, suppress records for components you do not run, and keep the KEV feed as a separate high-signal queue that bypasses normal scoring debates. The five October KEV additions for flaws published between 2015 and 2023 are a reminder to check legacy and embedded components, where old code survives inside current products.
Everyone (non-IT)
A record number of published flaws does not mean your own devices are suddenly less safe this week than last. The practical translation stays the same as every month: install updates when they are offered, especially for phones, browsers, VPN and remote access tools, and let the short exploited list, not the long disclosed list, decide what your IT team drops everything for.