# Source: NVD - CVE-2026-109618

NIST National Vulnerability Database: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · cve · primary · captured

# NVD - CVE-2026-109618

**NIST National Vulnerability Database** · [https://nvd.nist.gov/vuln/detail/CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618) · published 2026-10-21T14:17:09.357Z · added by `collector-primary` · slug `nvd-cve-2026-109618`

NVD page did not render in two Playwright captures (empty text); the authoritative copy is raw/nvd-api-2.0.json. NVD published 14:17:09Z, lastModified 17:18:24Z, status Modified. Only CNA (security@php.net, Secondary) CVSS v4 9.2; no NIST primary score yet. NVD CWEs: 416, 755, 824, 1325 (no 1419). No CISA KEV fields.

## What it says, as the collector read it

#### NVD CVE-2026-109618: notes

- The NVD detail page is JavaScript-rendered and did not render in our headless captures (blank / "Loading CVE Information"). The captures are kept as a record of the attempt; use raw/nvd-api-2.0.json (fetched 08:11Z from services.nvd.nist.gov/rest/json/cves/2.0).

- See source.json for published/lastModified. NVD shows only the CNA's CVSS v4.0 score (security@php.net, type "Secondary", baseScore 9.2, "CRITICAL"). There is no NIST primary assessment and no CPE configuration yet.

- NVD weaknesses: CWE-416, CWE-755, CWE-824, CWE-1325. The GHSA also lists CWE-1419.

- No cisaExploitAdd field (not in KEV at fetch time).

## Claims that cite it

No claim cites this source yet.

## Events that cite it

| When | Event | Time is |
|---|---|---|
| 2026-10-21 14:17:09 UTC | NVD publishes both CVEs with the CNA's CVSS v4.0 9.2 and no NIST score. | stated |

## The bytes
capture 20261022T081218Z · HTTP 200 · https://nvd.nist.gov/vuln/detail/cve-2026-109618- `headers.json` f81072c6a6dc3dda5884e2b701c37879b7d8762357ffa7bd4ea88ab95f9e5d6a 1,414 bytes
- `page.html` 5218b57d88785ba853fce0de8804f8994d73d4cb3209339fa458c4a5cbb9881f 2,453 bytes
- `provenance.json` f9105904aa37fc65ae54d1cb66b08b59b354c3eb7b20bf7cc925bd7ff4cfce78 935 bytes
- `rendered.html` b4880a9e6a29cbee557232a66f9db3531b225dd95a517433c6e326be8bb41e87 2,827 bytes
- `screenshot.png` 442aa587ff9ee582c291e7c7a8bca102504856b7a4db838cb313226e016f993e 106,759 bytes
- `text.txt` e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 bytes
capture 20261022T081302Z · HTTP 200 · https://nvd.nist.gov/vuln/detail/cve-2026-109618- `headers.json` 5d77eaec3eb1fe5d7fb3a76a35571380e31671576d24b40c26f0f87d75f2c610 1,414 bytes
- `page.html` f372c9f8983a6331efb78d85ea53abc653d4bbe75457c02c9a25d9cc1ec2086e 2,453 bytes
- `provenance.json` 578b5687fe8afa3ad4f74ab69b8ca2471a0b0ee0a650e832021623cf9e346931 935 bytes
- `rendered.html` 2aa4037a7f7c9c97111573860083b648f53df74a60cea8fc7f9205b76d01f36e 2,827 bytes
- `screenshot.png` 8d848319be976cd91ac761f8f5b19ff3d8547393428ff570f273a774b5094d39 106,512 bytes
- `text.txt` e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 bytes
raw, 1 files with SHA256SUMS- `nvd-api-2.0.json` dd864fa6ed53d4b549d2429fad6a22878ddb5a6def44b80cac0628cf4fdab438

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.8 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/nvd-cve-2026-109618/index.html