Critical and high-severity CVEs reach 383 in a week, against a median of 87

The figure counts CVE records added to the NIST National Vulnerability Database between Monday, Oct. 26 and Sunday, Nov. 1, 2026, that carry a severity score of 7.0 or above. The comparison is a median of 87 records a week across the five complete weeks before that window, according to the same NIST database. NIST's records for the period are complete through Nov. 5.

The five earlier weeks were not even: counts were 81 in the week of Sept. 21, 86 in the week of Sept. 28, 157 in the week of Oct. 5, 87 in the week of Oct. 12 and 501 in the week of Oct. 19, all measured on the same Monday-to-Sunday basis from NIST data. The week of Oct. 26 total of 383 is lower than the week of Oct. 19 figure of 501 and higher than the other four.

Two terms make the count readable. A CVE is a numbered catalogue entry for one publicly disclosed software vulnerability; it records that a flaw was published, not that anyone exploited it.

Records dated Nov. 1 in the week's total include CVE-2026-120240, a flaw in WAVLINK WN553X1-B firmware carrying a CVSS score of 9.9, and CVE-2026-120241, a flaw in several Ruijie switch models scored 7.5, as listed by the NIST National Vulnerability Database.

Room for disagreement

The baseline rests on five earlier weeks, one of which counted 501, so the median of 87 sits below the 122 median of the four most recent earlier complete weeks, against which the gap is smaller. A weekly count of published records also does not show whether any of these vulnerabilities were exploited.