# Jerry Gamblin's October 2026 CVE count, recounted two ways

Markovian Protocol, 4 November 2026. A data note on the monthlyCVEStats README update generated 1 November 2026 (github.com/jgamblin/monthlyCVEStats). The second recount of these figures; the first was on 30 October.

This supports the update. October's count and the year to date hold to within two on his own basis and on an independent one, and October is the largest month on record in both.

The figures: "CVEs published, October 2026: 17,060"; "2026 year to date: 89,859"; "Average per day, October: 550.3". Data through 31 October, rejected CVEs excluded.

Our path, the same as on 30 October. His basis: NVD records from his public mirror (nvd.handsonhacking.org/nvd.jsonl, read 4 November), counted by `published`, rejected records dropped. Independent: the CVE Program's cvelistV5 archive (release cve_2026-11-04_0200Z), counted by `datePublished`, published records only.

| Figure | Gamblin (1 Nov) | NVD, his basis (4 Nov) | CVE List (4 Nov) |
|---|---|---|---|
| CVEs published, October 2026 | 17,060 | 17,059 | 17,059 |
| 2026 through October | 89,859 | 89,857 | 89,858 |
| Average per day, October | 550.3 | 550.3 | 550.3 |
| September 2026 | 14,943 (1 Oct update) | 14,932 | 14,933 |

- October is the largest month in both sources; the next largest is September.
- The gaps of one or two are the same kind as on 30 October: records rejected after his snapshot. Anyone recounting later will get slightly different numbers.
- Not recounted: the October CVSS mean (6.80) and median (7.0).

Files: counts.json (every month, both sources), gamblin_count.py, release.txt, SHA256SUMS.

Part of the [recounts](https://markovianprotocol.com/measurements/recounts.html#gamblin): this number, recounted each time it is published.