Village
Log in
Concentric teal arcs spread from the lower-left corner across the frame, starting wide apart and packing tighter as they grow until they read as a solid field. Two of the arcs are crimson.

The surge in reported software flaws has reached Microsoft, Oracle and Google

Microsoft, Oracle and Google Chrome filed a fifth of October’s new CVEs, up from 4% across 2025, helping push October to a record 17,060. New CVEs have more than doubled this year, while additions to CISA’s list of flaws known to be exploited in attacks are up by about a third.

by Village Team

Every publicly reported security hole in software gets an ID called a CVE. Last month we found that these reports had doubled while the number confirmed as exploited in attacks had not. In October the largest software vendors became a bigger part of that rise, reporting more flaws in their own products than ever. Our Village monitor tracks every new CVE and every flaw the US Cybersecurity and Infrastructure Security Agency, CISA, lists as exploited in real attacks.

Microsoft, Oracle and Google filed a fifth of October’s new CVEs

CVEs published in October 2026 versus October 2025, by issuing organization. All issuers rose from 4,273 to 17,060; the eight issuers with the largest increases account for 8,263 of the 12,787 added records. VulnCheck: 157 to 2,478. Microsoft: 180 to 1,475. GitHub (open-source packages): 272 to 1,536. Oracle: 78 to 1,078. Google Chrome: 0 to 732. Patchstack (WordPress): 363 to 1,071. WPScan (WordPress): 23 to 566. Linux kernel: 651 to 1,051. All other issuers: 2,549 to 7,073.

  • Their share has quintupled. They filed about a fifth of October’s new CVEs, up from 4% across 2025, and their share began climbing in June.
  • Oracle’s quarterly security update is now 14 times its 2025 size. It carried about 80 CVEs a quarter through 2025, and about 1,100 in July and again in October. Oracle also began issuing updates between quarters this year, which added about 1,500 CVEs in August and September.
  • Microsoft had its biggest month yet. It filed eight times as many CVEs as last October, after running at about three times its 2025 pace from January through September.

Each of these companies reports flaws found in its own software, from Windows to Oracle’s databases and the Chrome browser. Their rise means the vendors behind much of the software businesses run are disclosing far more flaws in their own products. VulnCheck, a vulnerability-intelligence firm, is still the largest single source. The Linux kernel went the other way, filing half as many as in September.

October set another record: 17,060 new CVEs

Monthly counts of new CVE records, stacked by severity, from January 2022 to October 2026. Monthly volume averaged 4,013 in 2025, began rising in March 2026 and reached a record 17,060 in October, 4.3 times the 2025 average. Critical and High CVEs made up 48% of October’s records, down from 58% in August.

  • Monthly reports have quadrupled. October brought four times as many new CVEs as October 2025, and 4.3 times the average month of 2025.
  • The year is running at more than twice 2025’s level. From January through October, new CVEs ran 2.3 times their level in the same months of 2025, up from 2.1 times through September.
  • Medium-severity flaws drove the jump from September. They grew 30% month over month, six times as fast as Critical and High ones.

Flaws confirmed as exploited are up by about a third

New CVEs published and additions to CISA’s Known Exploited Vulnerabilities catalog, January 2024 to October 2026, each as a three-month average indexed to its 2025 monthly average. Published CVEs reached 368 in the three months ending October 2026, while exploited additions reached 180.

  • CISA’s additions are growing far more slowly than new CVEs. From January through October, CISA added 1.3 times as many flaws to its catalog as in the same months of 2025, against 2.3 times as many new CVEs.
  • CISA’s additions picked up in the fall. From August through October they ran at 1.8 times their 2025 pace, half the multiple for new CVEs.
  • New CVEs are less likely to be confirmed as exploited. Of CVEs published January through June, 0.28% were added to CISA’s catalog within 120 days, down from 0.39% a year earlier.

For security teams, the list of new flaws to assess has more than doubled this year, while the number confirmed as exploited in attacks has risen by about a third.

How we built this

This update uses the same Village monitor as our first study, built from NIST’s National Vulnerability Database and CISA’s Known Exploited Vulnerabilities catalog. It refreshes both every day, excludes rejected records and links each exploited flaw to its CVE record. The figures use the November 2 pull, with records published through October 31.

Counts reflect when CVEs were published and who filed them, not when flaws were found. Severity uses each record’s most recent score; newer records are more often unscored (9% of October’s), so recent severity counts can still change. CISA lists flaws once it confirms exploitation, sometimes years after an attack began, so catalog additions track confirmations rather than attacks, and the newest CVEs have had less time to be added.

Next up