{"metadata": {"vulnerability": "CVE-2026-48019", "count": 24, "kinds": {"milestone": 5, "sighting": 7, "kev": 0, "other": 12}}, "data": [{"timestamp": "2026-05-20T17:44:09.587Z", "date_only": false, "value": "2026-05-20T17:44:09.587Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-48019", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-05-31T22:00:00Z", "date_only": false, "value": "2026-05-31T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1753", "record": "WID-SEC-W-2026-1753", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-05-31T22:00:00Z", "date_only": false, "value": "2026-05-31T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1753", "record": "WID-SEC-W-2026-1753", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-31T22:00:00Z", "date_only": false, "value": "2026-05-31T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1753", "record": "WID-SEC-W-2026-1753", "field": "vulnerabilities.0.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-31T22:00:00Z", "date_only": false, "value": "2026-05-31T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1753", "record": "WID-SEC-W-2026-1753", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-06-01T00:00:00Z", "date_only": false, "value": "2026-06-01T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0670", "record": "CERTFR-2026-AVI-0670", "field": "last_revision_date"}, {"timestamp": "2026-06-01T00:00:00Z", "date_only": true, "value": "2026-06-01", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0670", "record": "CERTFR-2026-AVI-0670", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-06-01T00:00:00Z", "date_only": false, "value": "2026-06-01T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0670", "record": "CERTFR-2026-AVI-0670", "field": "revisions.0.revision_date"}, {"timestamp": "2026-06-01T10:42:23.697Z", "date_only": false, "value": "2026-06-01T10:42:23.697+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1753", "record": "WID-SEC-W-2026-1753", "field": "document.tracking.generator.date"}, {"timestamp": "2026-06-03T08:31:22.032Z", "date_only": false, "value": "2026-06-03T08:31:22.032553Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mnep2cl4ya23", "record": "CVE-2026-48019", "field": "creation_timestamp", "uuid": "52484a4d-6d96-48e0-891e-1b1b370ba283", "content": "Hidden Mail Manipulation Crisis: Laravel CRLF Injection Flaw (CVE-2026-48019) Opens Door to Email Hijacking and Header Abuse +\u00a0Video\n\n\ud83e\udded Introduction: A Silent Protocol Weakness Turning Trusted Emails Into Attack Vectors Modern web applications rely heavily on automated email systems for\u2026", "url": "https://bsky.app/profile/undercodenews.bsky.social/post/3mnep2cl4ya23"}, {"timestamp": "2026-06-04T17:04:45.023Z", "date_only": false, "value": "2026-06-04T17:04:45.023169Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mni47aj5bx2s", "record": "CVE-2026-48019", "field": "creation_timestamp", "uuid": "5fd50abe-2bb4-43e3-a304-ad05171af1d3", "content": "Critical #Laravel CRLF Injection Vulnerability (CVE-2026-48019) allows attackers to manipulate outbound emails. Upgrade to versions 13.10.0 or 12.60.0 immediately! #CyberSecurity #WebSecurity Link: thedailytechfeed.com/critical-lar...", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mni47aj5bx2s"}, {"timestamp": "2026-06-14T09:00:04Z", "date_only": false, "value": "2026-06-14T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/z4CK41gKHpfLp7kaaAJJNGb1sNYljSZXLMSwKCJ0b-jo3nA", "record": "CVE-2026-48019", "field": "creation_timestamp", "uuid": "8e1560aa-f28d-4e67-b4a3-3f5e946bf18d", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-04T22:11:40.811Z", "date_only": false, "value": "2026-09-04T22:11:40.811Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-48019", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-04T22:11:40.811Z", "date_only": false, "value": "2026-09-04T22:11:40.811Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-48019", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-04T23:17:09.143Z", "date_only": false, "value": "2026-09-04T23:17:09.143", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48019", "record": "FKIE_CVE-2026-48019", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-05T00:00:26.382Z", "date_only": false, "value": "2026-09-05T00:00:26.382097Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muq6dapvqu2m", "record": "CVE-2026-48019", "field": "creation_timestamp", "uuid": "4516e089-8dfb-4c43-89e1-e52d402de801", "content": "\ud83d\udfe0 CVE-2026-48019 - High (8.9)\n\nLaravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection v...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-48019/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muq6dapvqu2m"}, {"timestamp": "2026-09-05T04:11:29.271Z", "date_only": false, "value": "2026-09-05T04:11:29.271992Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3muqme6cngb2t", "record": "CVE-2026-48019", "field": "creation_timestamp", "uuid": "f4b8fb5b-630d-40e0-98d0-50c52790ab13", "content": "Laravel 12.60.0/13.10.0\u3088\u308a\u524d\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u3001\u30e1\u30fc\u30eb\u691c\u8a3c\u306eCRLF\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u304c\u3042\u308b\u3002\u3053\u308c\u306b\u3088\u308a\u3001\u30e6\u30fc\u30b6\u30fc\u63d0\u4f9b\u30a2\u30c9\u30ec\u30b9\u306b\u30e1\u30fc\u30eb\u3092\u9001\u308b\u30a2\u30d7\u30ea\u304c\u5f71\u97ff\u3092\u53d7\u3051\u3001\u672a\u8a8d\u8a3c\u306e\u653b\u6483\u8005\u2026\nCVE-2026-48019 CVSS 8.9 | HIGH", "url": "https://bsky.app/profile/postac001.bsky.social/post/3muqme6cngb2t"}, {"timestamp": "2026-09-08T13:01:14.091Z", "date_only": false, "value": "2026-09-08T13:01:14.091808Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-48019", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-08T13:01:14.091Z", "date_only": false, "value": "2026-09-08T13:01:14.091808Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48019", "record": "FKIE_CVE-2026-48019", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-08T13:01:38.157Z", "date_only": false, "value": "2026-09-08T13:01:38.157Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-48019", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-08T13:01:38.157Z", "date_only": false, "value": "2026-09-08T13:01:38.157Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-48019", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-08T17:00:03.818Z", "date_only": false, "value": "2026-09-08T17:00:03.818515Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3muzipahvzt2z", "record": "CVE-2026-48019", "field": "creation_timestamp", "uuid": "616a7ff5-e66c-4dcc-90c5-666c2b03d6cd", "content": "CVE-2026-48019: CRLF injection in Laravel (<12.60.0, <13.10.0) may let unauthenticated attackers tamper with outbound emails via user-supplied addresses. CVSS 8.9. No patch confirmed\u2014upgrade to 12.60.0 or 13.10.0 immediately. Details: https://www.valtersit.com/cve/CVE-2026-48019/", "url": "https://bsky.app/profile/hugovalters.bsky.social/post/3muzipahvzt2z"}, {"timestamp": "2026-09-08T17:00:07.322Z", "date_only": false, "value": "2026-09-08T17:00:07.322014Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/hugovalters/statuses/117236485519105661", "record": "CVE-2026-48019", "field": "creation_timestamp", "uuid": "76074f89-667e-42c0-aa02-3530f3093322", "content": "CVE-2026-48019: CRLF injection in Laravel (<12.60.0, <13.10.0) may let unauthenticated attackers tamper with outbound emails via user-supplied addresses. CVSS 8.9. No patch confirmed\u2014upgrade to 12.60.0 or 13.10.0 immediately. Details: https://www.valtersit.com/cve/CVE-2026-48019/", "url": "https://mastodon.social/users/hugovalters/statuses/117236485519105661"}, {"timestamp": "2026-09-10T20:41:33.140Z", "date_only": false, "value": "2026-09-10T20:41:33.140", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48019", "record": "FKIE_CVE-2026-48019", "field": "lastModified"}], "metrics": {"as_of": "2026-10-31T17:58:30.904Z", "anchors": {"origin": {"timestamp": "2026-05-31T22:00:00Z", "date_only": false, "value": "2026-05-31T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1753", "record": "WID-SEC-W-2026-1753", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-05-31T22:00:00Z", "date_only": false, "value": "2026-05-31T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1753", "record": "WID-SEC-W-2026-1753", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-06-14T09:00:04Z", "date_only": false, "value": "2026-06-14T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/z4CK41gKHpfLp7kaaAJJNGb1sNYljSZXLMSwKCJ0b-jo3nA", "record": "CVE-2026-48019", "field": "creation_timestamp", "uuid": "8e1560aa-f28d-4e67-b4a3-3f5e946bf18d", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 1162804.0, "hours": 323.00111111111113, "days": 13.45837962962963, "min_seconds": 1162804.0, "max_seconds": 1162804.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-05-31T22:00:00Z", "date_only": false, "value": "2026-05-31T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1753", "record": "WID-SEC-W-2026-1753", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-06-14T09:00:04Z", "date_only": false, "value": "2026-06-14T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/z4CK41gKHpfLp7kaaAJJNGb1sNYljSZXLMSwKCJ0b-jo3nA", "record": "CVE-2026-48019", "field": "creation_timestamp", "uuid": "8e1560aa-f28d-4e67-b4a3-3f5e946bf18d", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 13204710.904859, "hours": 3667.9752513497224, "days": 152.83230213957177, "min_seconds": 13204710.904859, "max_seconds": 13204710.904859, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-05-31T22:00:00Z", "date_only": false, "value": "2026-05-31T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1753", "record": "WID-SEC-W-2026-1753", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-31T17:58:30.904Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 12041906.904859, "hours": 3344.974140238611, "days": 139.37392250994213, "min_seconds": 12041906.904859, "max_seconds": 12041906.904859, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-06-14T09:00:04Z", "date_only": false, "value": "2026-06-14T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/z4CK41gKHpfLp7kaaAJJNGb1sNYljSZXLMSwKCJ0b-jo3nA", "record": "CVE-2026-48019", "field": "creation_timestamp", "uuid": "8e1560aa-f28d-4e67-b4a3-3f5e946bf18d", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-31T17:58:30.904Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}