Source · cve · primary · captured

NVD - CVE-2026-109618

NIST National Vulnerability Database · https://nvd.nist.gov/vuln/detail/CVE-2026-109618 · published 2026-10-21T14:17:09.357Z · added by collector-primary · slug nvd-cve-2026-109618

NVD page did not render in two Playwright captures (empty text); the authoritative copy is raw/nvd-api-2.0.json. NVD published 14:17:09Z, lastModified 17:18:24Z, status Modified. Only CNA (security@php.net, Secondary) CVSS v4 9.2; no NIST primary score yet. NVD CWEs: 416, 755, 824, 1325 (no 1419). No CISA KEV fields.

2026-10-21 14:17:09 UTC: NVD publishes both CVEs with the …NVD

What it says, as the collector read it

NVD CVE-2026-109618: notes

  • The NVD detail page is JavaScript-rendered and did not render in our headless captures (blank / "Loading CVE Information"). The captures are kept as a record of the attempt; use raw/nvd-api-2.0.json (fetched 08:11Z from services.nvd.nist.gov/rest/json/cves/2.0).
  • See source.json for published/lastModified. NVD shows only the CNA's CVSS v4.0 score (security@php.net, type "Secondary", baseScore 9.2, "CRITICAL"). There is no NIST primary assessment and no CPE configuration yet.
  • NVD weaknesses: CWE-416, CWE-755, CWE-824, CWE-1325. The GHSA also lists CWE-1419.
  • No cisaExploitAdd field (not in KEV at fetch time).

Claims that cite it

No claim cites this source yet.

Events that cite it

WhenEventTime is
2026-10-21 14:17:09 UTCNVD publishes both CVEs with the CNA's CVSS v4.0 9.2 and no NIST score.stated

The bytes

capture 20261022T081218Z · HTTP 200 · https://nvd.nist.gov/vuln/detail/cve-2026-109618
  • headers.json f81072c6a6dc3dda5884e2b701c37879b7d8762357ffa7bd4ea88ab95f9e5d6a 1,414 bytes
  • page.html 5218b57d88785ba853fce0de8804f8994d73d4cb3209339fa458c4a5cbb9881f 2,453 bytes
  • provenance.json f9105904aa37fc65ae54d1cb66b08b59b354c3eb7b20bf7cc925bd7ff4cfce78 935 bytes
  • rendered.html b4880a9e6a29cbee557232a66f9db3531b225dd95a517433c6e326be8bb41e87 2,827 bytes
  • screenshot.png 442aa587ff9ee582c291e7c7a8bca102504856b7a4db838cb313226e016f993e 106,759 bytes
  • text.txt e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 bytes
capture 20261022T081302Z · HTTP 200 · https://nvd.nist.gov/vuln/detail/cve-2026-109618
  • headers.json 5d77eaec3eb1fe5d7fb3a76a35571380e31671576d24b40c26f0f87d75f2c610 1,414 bytes
  • page.html f372c9f8983a6331efb78d85ea53abc653d4bbe75457c02c9a25d9cc1ec2086e 2,453 bytes
  • provenance.json 578b5687fe8afa3ad4f74ab69b8ca2471a0b0ee0a650e832021623cf9e346931 935 bytes
  • rendered.html 2aa4037a7f7c9c97111573860083b648f53df74a60cea8fc7f9205b76d01f36e 2,827 bytes
  • screenshot.png 8d848319be976cd91ac761f8f5b19ff3d8547393428ff570f273a774b5094d39 106,512 bytes
  • text.txt e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 bytes
raw, 1 files with SHA256SUMS
  • nvd-api-2.0.json dd864fa6ed53d4b549d2429fad6a22878ddb5a6def44b80cac0628cf4fdab438

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →