Source · cve · primary · captured

NVD - CVE-2026-109619

NIST National Vulnerability Database · https://nvd.nist.gov/vuln/detail/CVE-2026-109619 · published 2026-10-21T14:17:09.823Z · added by collector-primary · slug nvd-cve-2026-109619

Page rendered only as 'Loading CVE Information'; use raw/nvd-api-2.0.json. NVD published 14:17:09Z, lastModified 21:17:52Z. CNA CVSS v4 9.2 only; no NIST score. No KEV fields.

2026-10-21 14:17:09 UTC: NVD publishes both CVEs with the …NVD

What it says, as the collector read it

NVD CVE-2026-109619: notes

  • The NVD detail page is JavaScript-rendered and did not render in our headless captures (blank / "Loading CVE Information"). The captures are kept as a record of the attempt; use raw/nvd-api-2.0.json (fetched 08:11Z from services.nvd.nist.gov/rest/json/cves/2.0).
  • See source.json for published/lastModified. NVD shows only the CNA's CVSS v4.0 score (security@php.net, type "Secondary", baseScore 9.2, "CRITICAL"). There is no NIST primary assessment and no CPE configuration yet.
  • NVD weaknesses: CWE-416, CWE-755, CWE-824, CWE-1325. The GHSA also lists CWE-1419.
  • No cisaExploitAdd field (not in KEV at fetch time).

Claims that cite it

No claim cites this source yet.

Events that cite it

WhenEventTime is
2026-10-21 14:17:09 UTCNVD publishes both CVEs with the CNA's CVSS v4.0 9.2 and no NIST score.stated

The bytes

capture 20261022T081219Z · HTTP 200 · https://nvd.nist.gov/vuln/detail/cve-2026-109619
  • headers.json fc8d0ec5d6feaed052fd64b49abaebe2394f7ef3bc2ce70aee91e20e1306822e 1,413 bytes
  • page.html fbdf9ac8177380bc8093bab92baaa18402cc52721b3aaa5b037cb507c15a3bf3 2,453 bytes
  • provenance.json bad76168518f8666d20502a4cb32e9b3425e785e7abbf63160cbd9081db807b5 944 bytes
  • rendered.html 3784d224686072278cb9ed34c55c7390353818b2d9b35535eb289099d5bb536f 31,323 bytes
  • screenshot.png 56539f358f1226f93c35cc6828cee0c2edbcda7da8a3fce9e8deaad68f133fea 106,528 bytes
  • text.txt fbcf781e4294ea8f1f693ce52cf0e7c6ff9e8dff930df337294d54fb9f849466 839 bytes
raw, 1 files with SHA256SUMS
  • nvd-api-2.0.json 627fdaed31c96626e2dcc8af24a6acab1b2da1658bb32b5cf627e30149a0b61c

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →