{"metadata": {"vulnerability": "CVE-2026-19650", "count": 31, "kinds": {"milestone": 8, "sighting": 8, "kev": 0, "other": 15}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0303", "record": "NCSC-2026-0303", "field": "document.tracking.generator.date"}, {"timestamp": "2026-08-12T17:34:46.769Z", "date_only": false, "value": "2026-08-12T17:34:46.769Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-19650", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-17T00:00:00Z", "date_only": true, "value": "2026-08-17", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1037", "record": "CERTFR-2026-AVI-1037", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-08-17T20:04:56.287Z", "date_only": false, "value": "2026-08-17T20:04:56.287Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19650", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-17T20:04:56.287Z", "date_only": false, "value": "2026-08-17T20:04:56.287Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitLab", "record": "CVE-2026-19650", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-17T20:16:41Z", "date_only": false, "value": "2026-08-17T20:16:41Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-78MW-F4Q2-924Q", "record": "GHSA-78MW-F4Q2-924Q", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-08-17T20:16:41.910Z", "date_only": false, "value": "2026-08-17T20:16:41.910", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19650", "record": "FKIE_CVE-2026-19650", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-17T20:44:43.807Z", "date_only": false, "value": "2026-08-17T20:44:43.807063Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-19650", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-17T20:44:43.807Z", "date_only": false, "value": "2026-08-17T20:44:43.807063Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19650", "record": "FKIE_CVE-2026-19650", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-17T20:44:54.963Z", "date_only": false, "value": "2026-08-17T20:44:54.963Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-19650", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-17T20:44:54.963Z", "date_only": false, "value": "2026-08-17T20:44:54.963Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-19650", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-17T21:31:24Z", "date_only": false, "value": "2026-08-17T21:31:24Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-78MW-F4Q2-924Q", "record": "GHSA-78MW-F4Q2-924Q", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-17T21:31:24Z", "date_only": false, "value": "2026-08-17T21:31:24Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-78MW-F4Q2-924Q", "record": "GHSA-78MW-F4Q2-924Q", "field": "modified"}, {"timestamp": "2026-08-18T00:00:00Z", "date_only": false, "value": "2026-08-18T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1037", "record": "CERTFR-2026-AVI-1037", "field": "last_revision_date"}, {"timestamp": "2026-08-18T00:00:00Z", "date_only": false, "value": "2026-08-18T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1037", "record": "CERTFR-2026-AVI-1037", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-18T00:00:00Z", "date_only": false, "value": "2026-08-18T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1037", "record": "CERTFR-2026-AVI-1037", "field": "revisions.0.revision_date"}, {"timestamp": "2026-08-18T04:00:03.627Z", "date_only": false, "value": "2026-08-18T04:00:03.627034Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Hnh5kvBiZ07q02Wzarvcrlnf48Y4Gt3kSaOKhn6LmktH_wo", "record": "CVE-2026-19650", "field": "creation_timestamp", "uuid": "3793f18c-7367-408a-bfb4-3cd3da149caa", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-18T08:10:44.366Z", "date_only": false, "value": "2026-08-18T08:10:44.366248Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0303", "record": "NCSC-2026-0303", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-08-18T08:10:44.366Z", "date_only": false, "value": "2026-08-18T08:10:44.366248Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0303", "record": "NCSC-2026-0303", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-18T09:00:28.980Z", "date_only": false, "value": "2026-08-18T09:00:28.980534Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117115691222589671", "record": "CVE-2026-19650", "field": "creation_timestamp", "uuid": "a6ae54c2-5d3b-445f-ad56-5352873bef89", "content": "CRITICAL: GitLab CE/EE (v18.2+ to 19.2.4) patched CVE-2026-19478, a code injection bug allowing unauthenticated data modification/deletion via GraphQL. CSRF (CVE-2026-19650) also fixed. Upgrade to safe versions ASAP. https://radar.offseq.com/threat/gitlab-patches-critical-code-injection-vulnerability-ce00fcde61cd1cd5 #OffSeq #GitLab #Infosec #CVE", "url": "https://infosec.exchange/users/offseq/statuses/117115691222589671"}, {"timestamp": "2026-08-18T12:15:24.508Z", "date_only": false, "value": "2026-08-18T12:15:24.508314Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mte6ywejz72r", "record": "CVE-2026-19650", "field": "creation_timestamp", "uuid": "ba67a9e1-499a-4ad7-973c-c02940bd8d3d", "content": "\ud83d\udd17 CVE : CVE-2026-19478, CVE-2026-19650", "url": "https://bsky.app/profile/o2cloud.bsky.social/post/3mte6ywejz72r"}, {"timestamp": "2026-08-18T15:58:52.989Z", "date_only": false, "value": "2026-08-18T15:58:52.989750Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3mtelij4raj2x", "record": "CVE-2026-19650", "field": "creation_timestamp", "uuid": "79a6c321-1926-44cb-bcfa-cba97923a088", "content": "The patch also covers a less-severe CVE-2026-19650 (CVSS=7.1) CSRF issue, but since it requires user interaction, it's a pretty normal \"eval against your risk tolerance\" type thing.", "url": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3mtelij4raj2x"}, {"timestamp": "2026-08-18T16:15:08.113Z", "date_only": false, "value": "2026-08-18T16:15:08.113171Z", "kind": "sighting", "label": "Seen", "source": "https://www.ncsc.nl/alerts/ernstige-kwetsbaarheden-in-gitlab-producten-ontdekt-update-nu", "record": "CVE-2026-19650", "field": "creation_timestamp", "uuid": "e9a9902a-ebe4-471a-b9cb-c5a0652f3ae6", "url": "https://www.ncsc.nl/alerts/ernstige-kwetsbaarheden-in-gitlab-producten-ontdekt-update-nu"}, {"timestamp": "2026-08-19T23:41:17.196Z", "date_only": false, "value": "2026-08-19T23:41:17.196932Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mthvsbyaxt26", "record": "CVE-2026-19650", "field": "creation_timestamp", "uuid": "7ab9e170-a3d7-42bd-9f02-88a8c693a763", "content": "CVE-2026-19650 is trending. Hype score 1, currently #10 on cvemon.\n\nGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-19650", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mthvsbyaxt26"}, {"timestamp": "2026-08-21T09:07:36.177Z", "date_only": false, "value": "2026-08-21T09:07:36.177Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-GITLAB-2026-19650", "record": "BIT-GITLAB-2026-19650", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-22T14:01:45.195Z", "date_only": false, "value": "2026-08-22T14:01:45.195252Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/wdormann/statuses/117139525002330094", "record": "CVE-2026-19650", "field": "creation_timestamp", "uuid": "48b42d28-29e7-44fe-9a55-251cc3aa542f", "content": "We all know that CVE references age over time, and eventually none of the references exist anymore.  (See also: people who run websites usually don't understand the concept of the World Wide Web)\nCase in point:The recent GitLab CVE-2026-19478 and CVE-2026-19650\nOut of the three references, one of them simply doesn't exist, and one of them is hidden behind a login requirement, after which you're told that you cannot access it.\nWhy wait for references to age out over time when you can make them worthless right at publication time?  \ud83d\ude02", "url": "https://infosec.exchange/users/wdormann/statuses/117139525002330094"}, {"timestamp": "2026-08-25T13:41:12.163Z", "date_only": false, "value": "2026-08-25T13:41:12.163417Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0303", "record": "NCSC-2026-0303", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-08-25T13:41:12.163Z", "date_only": false, "value": "2026-08-25T13:41:12.163417Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0303", "record": "NCSC-2026-0303", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-02T13:07:13.537Z", "date_only": false, "value": "2026-09-02T13:07:13.537", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19650", "record": "FKIE_CVE-2026-19650", "field": "lastModified"}, {"timestamp": "2026-09-08T08:34:36.952Z", "date_only": false, "value": "2026-09-08T08:34:36.952Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-GITLAB-2026-19650", "record": "BIT-GITLAB-2026-19650", "field": "modified"}, {"timestamp": "2026-09-19T01:29:00.584Z", "date_only": false, "value": "2026-09-19T01:29:00.584291Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mvtjsilcak2x", "record": "CVE-2026-19650", "field": "creation_timestamp", "uuid": "238168bc-a5ea-49f5-83a8-f3b8694c81b6", "content": "\u300cGitLab\u300d\u306b\u6df1\u523b\u306a\u8106\u5f31\u6027 - \u8a8d\u8a3c\u306a\u3057\u3067\u516c\u958b\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u6539\u5909\u306e\u304a\u305d\u308c\n\nGitLab\u306f\u3001\u540c\u793e\u958b\u767a\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u5411\u3051\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u63d0\u4f9b\u958b\u59cb\u3057\u305f\u3002\u300c\u30af\u30ea\u30c6\u30a3\u30ab\u30eb\uff08Critical\uff09\u300d\u3068\u3055\u308c\u308b\u8106\u5f31\u6027\u306a\u3069\u3092\u89e3\u6d88\u3057\u305f\u3068\u3057\u3001\u65e9\u6025\u306b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u5b9f\u65bd\u3059\u308b\u3088\u3046\u5f37\u304f\u6c42\u3081\u3066\u3044\u308b\u3002\n\n...\n\n\u300cCVE-2026-19478\u300d\u306f\u3001\u30b3\u30fc\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u3002\u8a8d\u8a3c\u3092\u5fc5\u8981\u3068\u3059\u308b\u3053\u3068\u306a\u304f\u3001\u7279\u5b9a\u6761\u4ef6\u4e0b\u3067GraphQL\u30c7\u30a3\u30ec\u30af\u30c6\u30a3\u30d6\u3092\u901a\u3058\u3066\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u516c\u958b\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u3084\u30e6\u30fc\u30b6\u30fc\u30c7\u30fc\u30bf\u3092\u6539\u3056\u3093\u3057\u305f\u308a\u3001\u524a\u9664\u3059\u308b\u3053\u3068\u304c\u53ef\u80fd\u3068\u306a\u308b\u3002\n\n\u300cCVE-2026-19650\u300d\u306f\u3001\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30ea\u30af\u30a8\u30b9\u30c8\u30d5\u30a9\u30fc...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mvtjsilcak2x"}], "metrics": {"as_of": "2026-11-02T02:54:53.900Z", "anchors": {"origin": {"timestamp": "2026-08-17T20:04:56.287Z", "date_only": false, "value": "2026-08-17T20:04:56.287Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19650", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-08-17T20:04:56.287Z", "date_only": false, "value": "2026-08-17T20:04:56.287Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19650", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-08-18T04:00:03.627Z", "date_only": false, "value": "2026-08-18T04:00:03.627034Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Hnh5kvBiZ07q02Wzarvcrlnf48Y4Gt3kSaOKhn6LmktH_wo", "record": "CVE-2026-19650", "field": "creation_timestamp", "uuid": "3793f18c-7367-408a-bfb4-3cd3da149caa", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 28507.34, "hours": 7.918705555555555, "days": 0.3299460648148148, "min_seconds": 28507.34, "max_seconds": 28507.34, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-17T20:04:56.287Z", "date_only": false, "value": "2026-08-17T20:04:56.287Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19650", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-08-18T04:00:03.627Z", "date_only": false, "value": "2026-08-18T04:00:03.627034Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Hnh5kvBiZ07q02Wzarvcrlnf48Y4Gt3kSaOKhn6LmktH_wo", "record": "CVE-2026-19650", "field": "creation_timestamp", "uuid": "3793f18c-7367-408a-bfb4-3cd3da149caa", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 6590997.613434, "hours": 1830.8326703983332, "days": 76.28469459993056, "min_seconds": 6590997.613434, "max_seconds": 6590997.613434, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-17T20:04:56.287Z", "date_only": false, "value": "2026-08-17T20:04:56.287Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19650", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-02T02:54:53.900Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 6562490.273434, "hours": 1822.913964842778, "days": 75.95474853511574, "min_seconds": 6562490.273434, "max_seconds": 6562490.273434, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-18T04:00:03.627Z", "date_only": false, "value": "2026-08-18T04:00:03.627034Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Hnh5kvBiZ07q02Wzarvcrlnf48Y4Gt3kSaOKhn6LmktH_wo", "record": "CVE-2026-19650", "field": "creation_timestamp", "uuid": "3793f18c-7367-408a-bfb4-3cd3da149caa", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-02T02:54:53.900Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}