{"vulnerability": "CVE-2026-10189", "sightings": [{"uuid": "7b5434c3-529c-482c-9f53-674bd7d3a0b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10189", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mn654uzzeu27", "content": "CVE-2026-10189 - Tenda W12 httpd cgiSysTimeInfoSet stack-based overflow\nCVE ID : CVE-2026-10189\n \n Published : May 31, 2026, 4:16 p.m. | 56\u00a0minutes ago\n \n Description : A vulnerability has been found in Tenda W12 3.0.0.7(4763). This vulnerability affects the function cgiSysTim...", "creation_timestamp": "2026-05-31T17:54:41.787646Z"}, {"uuid": "0375bd3a-4c27-4c19-ac8d-026180f9a5c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10189", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mn6b52zenf2j", "content": "Tenda W12 3.0.0.7(4763) \u306e httpd \u3067\u30b9\u30bf\u30c3\u30af\u30d0\u30c3\u30d5\u30a1\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u8106\u5f31\u6027\u304c\u3042\u308a\u3001\u9060\u9694\u304b\u3089\u653b\u6483\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\nCVE-2026-10189 CVSS 8.8 | HIGH", "creation_timestamp": "2026-05-31T19:06:23.330980Z"}, {"uuid": "3cd6a678-825c-4d05-96de-eba91697c287", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-10189", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mn7kpk4yjd2n", "content": "HIGH severity: Tenda W12 (v3.0.0.7) buffer overflow lets remote attackers execute code. No patch yet \u2014 restrict exposure & monitor vendor updates. \ud83d\udd12 https://radar.offseq.com/threat/cve-2026-10189-stack-based-buffer-overflow-in-tend-813ea883 #OffSeq #Vulnerability #RouterSecurity", "creation_timestamp": "2026-06-01T07:30:27.221780Z"}, {"uuid": "13a0d06d-0842-4d01-8470-e6218aa78635", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-10189", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116673676840471246", "content": "\u26a0\ufe0f CVE-2026-10189: HIGH severity stack-based buffer overflow in Tenda W12 (v3.0.0.7). Exploitable remotely, risk of code execution. No patch \u2014 restrict access & monitor for updates. https://radar.offseq.com/threat/cve-2026-10189-stack-based-buffer-overflow-in-tend-813ea883 #OffSeq #Vulnerability #Tenda #RouterSecurity", "creation_timestamp": "2026-06-01T07:30:32.617645Z"}, {"uuid": "ebe4993b-592e-4e03-92fd-7713a319f8ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10189", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mn7qf436gf2j", "content": "CVE-2026-10189 - Critical stack buffer overflow in Tenda W12 3.0.0.7(4763). Remote attack possible via /bin/httpd cgiSysTimeInfoSet. CVSS 8.8. Unpatched. Isolate affected devices immediately. #CVE #Tenda #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-10189/", "creation_timestamp": "2026-06-01T09:11:58.910432Z"}, {"uuid": "72b25472-2cbb-44b2-bfa0-5f268acbcf7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101894", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwltrgbz6p2g", "content": "\ud83d\udd34 CVE-2026-101894 - Critical (9.1)\n\nThe decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default dec...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-101894/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-28T17:31:16.271754Z"}, {"uuid": "9655ca1d-2c58-46ab-92e5-3902a1320837", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101898", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mwltt3iwtr24", "content": "CVE-2026-101901: axios patched three flaws in its Node.js and browser HTTP client before 1.20.0: an HTTP/2 denial of service, an HTTP/2 proxy and DNS bypass (CVE-2026-101898), and fetch adapter header injection (CVE-2026-101900). Update to 1.20.0.", "creation_timestamp": "2026-09-28T17:32:10.255779Z"}, {"uuid": "bd41057b-53ae-49a1-94e8-5e5e272c8626", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101891", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwlut53lqq25", "content": "CVE-2026-101891 - watchguard ap\nThe internal API on WatchGuard Access Points can be reached without any login, so anyone who can reach the device on the network can obtain a valid API session. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#watchguardap #watchguard #CVE #infosec", "creation_timestamp": "2026-09-28T17:50:06.047284Z"}, {"uuid": "ff176199-e120-4508-bfb2-f5a870c519d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101891", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwlvuqf3zv2r", "content": "\ud83d\udea8 CVE-2026-101891 \u2014 CVSS 9.3 CRITICAL\n\nAn improper access control vulnerability in an internal API service on WatchGuard Access Points allows an u...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-101891\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-28T18:08:53.048777Z"}, {"uuid": "ef4d7475-e9fc-4363-b2ca-73e963b3e19c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101894", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwlvuycgos25", "content": "\ud83d\udea8 CVE-2026-101894 \u2014 CVSS 9.1 CRITICAL\n\nThe decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(in...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-101894\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-28T18:09:01.431713Z"}, {"uuid": "7b797351-b4ba-497b-8a6f-188d99cf6350", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101894", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwlvezkhfx2i", "content": "CVE-2026-101894 - decompress\nThe decompress library used in Node.js applications may let a specially crafted archive place files outside the intended extraction folder. This could let an attacker modify\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#decompress #xhmikosr #CVE #infosec", "creation_timestamp": "2026-09-28T18:00:06.169727Z"}, {"uuid": "1a6ca52f-3cd9-4cdc-b7b4-8cf2a3aac6bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101891", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117350185114320818", "content": "Watch Guard APs with two sev:CRIT and one sev:HIGH CVE.\nhttps://psirt.watchguard.com/CVE-2026-101891\nhttps://psirt.watchguard.com/CVE-2026-86102\nhttps://psirt.watchguard.com/CVE-2026-87969/", "creation_timestamp": "2026-09-28T18:55:22.952080Z"}, {"uuid": "a79f1fe8-0897-407c-902a-e3246aea0508", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101894", "type": "seen", "source": "Telegram/6_Oeq2CRJE8os8WHnCwXZbDEI0tCi0KqIlGVcCySNndfyQ4", "content": "", "creation_timestamp": "2026-09-29T03:00:11.000000Z"}, {"uuid": "85c10649-6564-4a1e-8178-239868dd30fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-101895", "type": "published-proof-of-concept", "source": "https://github.com/angular/angular/security/advisories/GHSA-f67j-2jqw-jpq7", "content": "", "creation_timestamp": "2026-09-09T20:36:09.000000Z"}, {"uuid": "d0b19af9-8e5e-4738-9523-2561fc64501c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101894", "type": "seen", "source": "https://t.me/GithubRedTeam/103707", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-101894\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 00:50:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-101894 PoC: @xhmikosr/decompress symlink-chain archive path traversal (bypass CVE-2026-53486). Node lab + lockfile scan + mass evil.tar upload exploit. CVSS 9.1. https://pocbit.org/pocs/cve-2026-101894\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-29T01:00:07.000000Z"}, {"uuid": "e0258373-39d1-4309-b701-9764a0366b55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101894", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103707", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-101894\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 00:50:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-101894 PoC: @xhmikosr/decompress symlink-chain archive path traversal (bypass CVE-2026-53486). Node lab + lockfile scan + mass evil.tar upload exploit. CVSS 9.1. https://pocbit.org/pocs/cve-2026-101894\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-29T01:00:07.000000Z"}, {"uuid": "d0843b88-6c61-4932-be84-cab2a27b4c14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101894", "type": "published-proof-of-concept", "source": "Telegram/6_Oeq2CRJE8os8WHnCwXZbDEI0tCi0KqIlGVcCySNndfyQ4", "content": "", "creation_timestamp": "2026-09-29T03:00:11.000000Z"}, {"uuid": "3a603eec-462e-4e10-96b6-bf748c684261", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-101891", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/watchguard-security-advisory-av26-972", "content": "", "creation_timestamp": "2026-09-29T05:52:20.000000Z"}, {"uuid": "10ca2e23-ea4f-401a-9312-1aa858b58445", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-101898", "type": "seen", "source": "https://www.acn.gov.it/portale/w/disponibili-poc-per-lo-sfruttamento-di-7-vulnerabilita-in-prodotti-axios", "content": "", "creation_timestamp": "2026-09-29T07:31:20.000000Z"}, {"uuid": "e698ac91-98fa-41ad-ab0b-cb3dee8a0bc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101894", "type": "seen", "source": "https://gist.github.com/alon710/c3b0d10c48acd055c898802fe5191eff", "content": "# CVE-2026-101894: CVE-2026-101894: Arbitrary File Read/Write via Symbolic Link Chaining in @xhmikosr/decompress\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-101894\n\n## Summary\nCVE-2026-101894 is a critical path traversal vulnerability in @xhmikosr/decompress before versions 10.2.2 and 11.1.4, stemming from an incomplete hardening bypass of CVE-2026-53486 where static lexical containment checks fail to detect kernel-level resolution of crafted symlink chains, allowing arbitrary local file modification and execution.\n\n## TL;DR\nA path traversal vulnerability in @xhmikosr/decompress allows attackers to write files outside the target directory via a crafted chain of symlink entries, bypassing lexical containment checks.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Score**: 9.1\n- **EPSS Score**: 0.00814\n- **Exploit Status**: PoC\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @xhmikosr/decompress\n- decompress\n- **@xhmikosr/decompress**: < 10.2.2 (Fixed in: `10.2.2`)\n- **@xhmikosr/decompress**: < 11.1.4 (Fixed in: `11.1.4`)\n- **decompress**: <= 4.2.1 (Fixed in: `None`)\n\n## Mitigation\n\n- Upgrade @xhmikosr/decompress to fixed versions\n- Replace legacy 'decompress' library with maintained fork\n- Run extraction processes in isolated, non-root sandbox environments\n\n**Remediation Steps:**\n1. Identify vulnerable packages using npm audit\n2. Update package.json dependencies to >=10.2.2 or >=11.1.4\n3. Replace any occurrences of 'decompress' with '@xhmikosr/decompress'\n4. Rebuild lockfiles and deploy patches\n\n## References\n\n- [Official Security Advisory](https://github.com/XhmikosR/decompress/security/advisories/GHSA-hrh2-vp3x-79xf)\n- [NVD Vulnerability Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-101894)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-101894)\n- [Release Version 10.2.2](https://github.com/XhmikosR/decompress/releases/tag/v10.2.2)\n- [Release Version 11.1.4](https://github.com/XhmikosR/decompress/releases/tag/v11.1.4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-101894) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T03:30:30.000000Z"}, {"uuid": "0124a01b-28e5-4d40-8357-5660ab4f8b02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-101899", "type": "published-proof-of-concept", "source": "https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx", "content": "", "creation_timestamp": "2026-09-16T09:03:23.000000Z"}, {"uuid": "21fe740a-4a36-423c-ba22-bdbef5ff96b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-101898", "type": "published-proof-of-concept", "source": "https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v", "content": "", "creation_timestamp": "2026-09-16T08:58:16.000000Z"}, {"uuid": "c781099e-46be-4041-8ee9-fb96bb647b91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101898", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mwsspmc3m62t", "content": "\n\ud83d\udea8 New HIGH CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-101898 impacts axios in 4 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/719\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-10-01T12:00:58.272379Z"}]}