23,469 CVEs in 45 Days: Who Published Them, 1 Sep to 15 Oct 2026

From 1 September to 15 October 2026, 23,673 CVE records were published according to the NVD API. 204 of them are already rejected, leaving 23,469. That is an average of about 521 a day.

We broke the total down by the source that published each record. 279 distinct sources contributed, but four of them, VulnCheck, Microsoft, kernel.org and GitHub, account for 42.4% of the volume. Here's how we counted and what the mix means for anyone triaging the feed.

How we counted

We queried the NVD CVE API 2.0 on 18 October 2026 between 08:09 and 08:15 UTC, filtering on publication date. The API returns at most 2,000 records per page, and unauthenticated clients are rate limited, so sleep between pages and retry any page that returns HTTP 429.

for i in $(seq 0 2000 22000); do
  curl -sS -o "p_$i.json" "https://services.nvd.nist.gov/rest/json/cves/2.0?\
pubStartDate=2026-09-01T00:00:00.000Z&pubEndDate=2026-10-15T23:59:59.999Z\
&resultsPerPage=2000&startIndex=$i"
  sleep 8
done

# Map each record's sourceIdentifier to an organization name
for i in 0 1000; do
  curl -sS -o "src_$i.json" \
    "https://services.nvd.nist.gov/rest/json/source/2.0?resultsPerPage=1000&startIndex=$i"
  sleep 8
done

import json, glob, collections, datetime as dt

cves = {}
for p in glob.glob("p_*.json"):
    for v in json.load(open(p))["vulnerabilities"]:
        cves[v["cve"]["id"]] = v["cve"]

name = {}
for p in glob.glob("src_*.json"):
    for s in json.load(open(p))["sources"]:
        for i in s.get("sourceIdentifiers", []):
            name[i] = s["name"]

live = [c for c in cves.values() if c["vulnStatus"] != "Rejected"]
print(len(cves), "records,", len(live), "not rejected")

cna = collections.Counter(name.get(c["sourceIdentifier"], c["sourceIdentifier"]) for c in live)
print(len(cna), "distinct sources")
running = 0
for n, k in cna.most_common(12):
    running += k
    print(n, k, round(100 * k / len(live), 1), round(100 * running / len(live), 1))

def week(ts):
    d = dt.date.fromisoformat(ts[:10])
    return str(d - dt.timedelta(days=d.weekday()))

print(sorted(collections.Counter(week(c["published"]) for c in live).items()))

Every page reported the same totalResults of 23,673, so the set didn't shift during the download.

What's affected

Top 12 sources by CVEs published, 1 September to 15 October 2026:

The remaining 267 sources published 6,930 CVEs between them. 52 sources published exactly one.

Some of the volume is very bursty. Microsoft's records landed mostly on its two Patch Tuesdays: 965 on 8 September and 1,407 on 13 October. All 634 Oracle records were published on 15 September. Kernel.org spreads out more, with its largest days at 600 (17 September) and 430 (11 September).

Three CNAs that focus on WordPress plugins and themes, Patchstack, WPScan and Wordfence, published 2,585 CVEs together. That is more than Microsoft's 2,447.

Weekly volume (weeks start Monday; the first week covers 1 to 6 September only, the last covers 12 to 15 October only):

How to check if you're exposed

Most teams can ignore most of this feed. The question is which slices land on your stack. Run the CNA count against your own findings: export open CVE IDs from your scanner into my_cves.txt, then reuse the downloaded pages:

python3 -I -c '
import json, glob, collections
mine = set(open("my_cves.txt").read().split())
name = {i: s["name"] for p in glob.glob("src_*.json")
        for s in json.load(open(p))["sources"] for i in s.get("sourceIdentifiers", [])}
hits = collections.Counter()
for p in glob.glob("p_*.json"):
    for v in json.load(open(p))["vulnerabilities"]:
        c = v["cve"]
        if c["id"] in mine:
            hits[name.get(c["sourceIdentifier"], c["sourceIdentifier"])] += 1
print(hits.most_common(15))
'

If kernel.org dominates your list, your container base images are the lever. If GitHub dominates, it's your open source dependencies.

What to do now

1. Route by source. Microsoft and Oracle CVEs arrive in batches on known days. Plan patch capacity for those days rather than treating them as surprises.
2. Handle kernel CVEs at the image level. 2,383 kernel.org CVEs in 45 days can't be triaged one by one. Rebuild on patched base images and kernels on a schedule.
3. Skip WordPress plugin CVEs if you don't run WordPress. 2,585 records came from the three WordPress-focused CNAs. Filter them out of dashboards that don't need them.
4. Match open source CVEs on package identifiers. 1,192 of the 2,218 GitHub CNA records in this window also appear as aliases in GitHub-reviewed advisories (advisory-database commit ee0a9a6), which carry package names and version ranges. Those match against an SBOM more reliably than product strings.
5. Measure your own share. Run the snippet above monthly. A sudden jump from one CNA tells you where your exposure is growing.

Why it matters

Raw CVE counts make the problem look unmanageable: 521 a day on average in this window. But the feed is not one stream. It's a handful of large, predictable publishers plus a long tail. Once you see which publishers map to your stack, most of the volume falls away.

The concentration also means process changes at a few CNAs move the total. When one source publishes 600 records in a day, that is a batch, not a spike in risk.

Try it yourself

Take last month's findings from your scanner and group them by the CNA that published each CVE. Then group them again by whether a fixed version exists. The two views together tell you where to spend the week. The demo below walks through a vulnerability management view built around that kind of grouping.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NVD CVE API 2.0 query used for this post
• NVD Source API 2.0
• GitHub Advisory Database repository