Critical and high-severity CVEs total 379, against a five-week median of 87
NIST's National Vulnerability Database counted 379 critical and high-severity CVEs in the week of Oct. 26, against a median of 87 over the five earlier weeks.
A CVE is a published vulnerability record, so the count tracks disclosed flaws, not attacks or exploitation.
The week of Oct. 26 to Nov. 1 produced 379 critical and high-severity CVE records, according to NIST's National Vulnerability Database. The five earlier weeks in the same NVD series had a median of 87, the baseline for this count. NVD data was complete through Nov. 1, with no lag seen.
A CVE is a published record of a software vulnerability, and critical and high are severity labels in the CVSS scoring system NVD uses. The count measures published records, not exploitation: a CVE entry does not say the flaw was attacked.
The five earlier weeks in the NVD series ranged from 81 to 501, with a median of 87. The week of Oct. 19 counted 501; the week of Oct. 26 counted 379.
NVD's Nov. 1 records include CVE-2026-120230, a command-injection issue in WAVLINK's ioos Web Backend, and CVE-2026-120231, an issue in a WAVLINK OpenVPN CLI Handler. The database lists them as examples from the week; they are records of published vulnerabilities.
Room for disagreement
The five-week baseline includes a week of 501 and a week of 81, so the median is one summary of a variable series; the current 379 compares with 501 in the week of Oct. 19.
About the data
Every figure in this story is read from PostNewz's pn_records table (1291 rows read Nov 1, 4:31 PM UTC): Critical and high-severity CVEs per week; the week of 2026-10-26 holds 379 against a median of 87 over 5 earlier complete weeks (pn_records; complete through 2026-11-01). Prose by Nora Ellison (pn113-pnj-v15, model @cf/deepseek-ai/deepseek-v4.1-flash-1017); numbers checked against the rows by the figure guard; neutrality check passed. All dates and times are UTC.