{"vulnerability": "cve-2026-19650", "sightings": [{"uuid": "ba67a9e1-499a-4ad7-973c-c02940bd8d3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19650", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mte6ywejz72r", "content": "\ud83d\udd17 CVE : CVE-2026-19478, CVE-2026-19650", "creation_timestamp": "2026-08-18T12:15:24.508314Z"}, {"uuid": "79a6c321-1926-44cb-bcfa-cba97923a088", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19650", "type": "seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3mtelij4raj2x", "content": "The patch also covers a less-severe CVE-2026-19650 (CVSS=7.1) CSRF issue, but since it requires user interaction, it's a pretty normal \"eval against your risk tolerance\" type thing.", "creation_timestamp": "2026-08-18T15:58:52.989750Z"}, {"uuid": "e9a9902a-ebe4-471a-b9cb-c5a0652f3ae6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-19650", "type": "seen", "source": "https://www.ncsc.nl/alerts/ernstige-kwetsbaarheden-in-gitlab-producten-ontdekt-update-nu", "content": "", "creation_timestamp": "2026-08-18T16:15:08.113171Z"}, {"uuid": "98de571c-9660-48be-9a75-7a6ef96129f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19650", "type": "published-proof-of-concept", "source": "Telegram/Hnh5kvBiZ07q02Wzarvcrlnf48Y4Gt3kSaOKhn6LmktH_wo", "content": "", "creation_timestamp": "2026-08-19T00:00:27.067986Z"}, {"uuid": "7ab9e170-a3d7-42bd-9f02-88a8c693a763", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19650", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mthvsbyaxt26", "content": "CVE-2026-19650 is trending. Hype score 1, currently #10 on cvemon.\n\nGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-19650", "creation_timestamp": "2026-08-19T23:41:17.196932Z"}, {"uuid": "3793f18c-7367-408a-bfb4-3cd3da149caa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19650", "type": "published-proof-of-concept", "source": "Telegram/Hnh5kvBiZ07q02Wzarvcrlnf48Y4Gt3kSaOKhn6LmktH_wo", "content": "", "creation_timestamp": "2026-08-18T04:00:03.627034Z"}, {"uuid": "a6ae54c2-5d3b-445f-ad56-5352873bef89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19650", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117115691222589671", "content": "CRITICAL: GitLab CE/EE (v18.2+ to 19.2.4) patched CVE-2026-19478, a code injection bug allowing unauthenticated data modification/deletion via GraphQL. CSRF (CVE-2026-19650) also fixed. Upgrade to safe versions ASAP. https://radar.offseq.com/threat/gitlab-patches-critical-code-injection-vulnerability-ce00fcde61cd1cd5 #OffSeq #GitLab #Infosec #CVE", "creation_timestamp": "2026-08-18T09:00:28.980534Z"}, {"uuid": "48b42d28-29e7-44fe-9a55-251cc3aa542f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19650", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/117139525002330094", "content": "We all know that CVE references age over time, and eventually none of the references exist anymore.  (See also: people who run websites usually don't understand the concept of the World Wide Web)\nCase in point:The recent GitLab CVE-2026-19478 and CVE-2026-19650\nOut of the three references, one of them simply doesn't exist, and one of them is hidden behind a login requirement, after which you're told that you cannot access it.\nWhy wait for references to age out over time when you can make them worthless right at publication time?  \ud83d\ude02", "creation_timestamp": "2026-08-22T14:01:45.195252Z"}]}