# Source: NVD - CVE-2026-109619

NIST National Vulnerability Database: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · cve · primary · captured

# NVD - CVE-2026-109619

**NIST National Vulnerability Database** · [https://nvd.nist.gov/vuln/detail/CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619) · published 2026-10-21T14:17:09.823Z · added by `collector-primary` · slug `nvd-cve-2026-109619`

Page rendered only as 'Loading CVE Information'; use raw/nvd-api-2.0.json. NVD published 14:17:09Z, lastModified 21:17:52Z. CNA CVSS v4 9.2 only; no NIST score. No KEV fields.

## What it says, as the collector read it

#### NVD CVE-2026-109619: notes

- The NVD detail page is JavaScript-rendered and did not render in our headless captures (blank / "Loading CVE Information"). The captures are kept as a record of the attempt; use raw/nvd-api-2.0.json (fetched 08:11Z from services.nvd.nist.gov/rest/json/cves/2.0).

- See source.json for published/lastModified. NVD shows only the CNA's CVSS v4.0 score (security@php.net, type "Secondary", baseScore 9.2, "CRITICAL"). There is no NIST primary assessment and no CPE configuration yet.

- NVD weaknesses: CWE-416, CWE-755, CWE-824, CWE-1325. The GHSA also lists CWE-1419.

- No cisaExploitAdd field (not in KEV at fetch time).

## Claims that cite it

No claim cites this source yet.

## Events that cite it

| When | Event | Time is |
|---|---|---|
| 2026-10-21 14:17:09 UTC | NVD publishes both CVEs with the CNA's CVSS v4.0 9.2 and no NIST score. | stated |

## The bytes
capture 20261022T081219Z · HTTP 200 · https://nvd.nist.gov/vuln/detail/cve-2026-109619- `headers.json` fc8d0ec5d6feaed052fd64b49abaebe2394f7ef3bc2ce70aee91e20e1306822e 1,413 bytes
- `page.html` fbdf9ac8177380bc8093bab92baaa18402cc52721b3aaa5b037cb507c15a3bf3 2,453 bytes
- `provenance.json` bad76168518f8666d20502a4cb32e9b3425e785e7abbf63160cbd9081db807b5 944 bytes
- `rendered.html` 3784d224686072278cb9ed34c55c7390353818b2d9b35535eb289099d5bb536f 31,323 bytes
- `screenshot.png` 56539f358f1226f93c35cc6828cee0c2edbcda7da8a3fce9e8deaad68f133fea 106,528 bytes
- `text.txt` fbcf781e4294ea8f1f693ce52cf0e7c6ff9e8dff930df337294d54fb9f849466 839 bytes
raw, 1 files with SHA256SUMS- `nvd-api-2.0.json` 627fdaed31c96626e2dcc8af24a6acab1b2da1658bb32b5cf627e30149a0b61c

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.8 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/nvd-cve-2026-109619/index.html