Why Unofficial Download Sources Are Still a Security Risk in 2026

Security Risk in 2026: why unofficial download sources still put users at risk, and how to verify safe, official install paths before installing software...

CVE-2026-35177

creationtimestamp| type| source ---|---|--- 2026-04-28 02:24:21+00:00| seen| https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mkjjqr2z3bt2...

CVE-2026-23486

creationtimestamp| type| source ---|---|--- 2026-04-28 00:08:54+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-23486.yaml 2026-04-28 21:03:04+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mklibctkvh2z...

CVE-2026-7088 SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection

A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?action=savereceiving. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit...

CVE-2026-43983

creationtimestamp| type| source ---|---|--- 2026-04-26 17:45:52+00:00| published-proof-of-concept| https://github.com/pocket-id/pocket-id/security/advisories/GHSA-w6p7-2fxx-4f44 2026-07-28 16:35:14+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-w6p7-2fxx-4f44...

CVE-2026-7025

creationtimestamp| type| source ---|---|--- 2026-04-26 09:47:33+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mkfbllampu27...

CVE-2026-7026

creationtimestamp| type| source ---|---|--- 2026-04-26 07:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116469833860355609 2026-04-26 07:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mkezwideoq2y...

CVE-2026-7002

creationtimestamp| type| source ---|---|--- 2026-04-26 02:04:45+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mkehpzisv627...

CVE-2026-31681

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtmultiport: validate range encoding in checkentry portsmatchv1 treats any non-zero pflags entry as the start of a port range and unconditionally consumes the next ports element as the range end. The checkentry path...

CVE-2026-41322 @astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed

@astrojs/node allows Astro to deploy your SSR site to Node targets. Prior to 10.0.5, requesting a static js/css resources from astro path with an incorrect/malformed if-match header returns a 500 error with a one year cache lifetime instead of 412 in some cases. This has the effect that all...

CVE-2026-41322

CVE-2026-41322 affects @astrojs/node used with Astro. Prior to 10.0.5, when a malformed/incorrect If-Match header triggers a precondition failure for static files under /_astro/, the underlying stream emits an error after emitting a file event and the server responds with 500 Internal Server Erro...

CVE-2026-38743

creationtimestamp| type| source ---|---|--- 2026-04-24 15:27:36+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mkatnsscyw2u...

CVE-2026-41309

creationtimestamp| type| source ---|---|--- 2026-04-24 03:57:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk7n43ib3e2n 2026-04-24 05:18:58+00:00| seen| Telegram/kIuLSWSF-lSSH53f04z2OEjKv8ykvXtTNiYc9dOAOt4c...

Critical Photon OS Security Update - PHSA-2026-5.0-91-0831

Updates of 'erlang' packages of Photon OS have been released...

CVE-2026-4117

creationtimestamp| type| source ---|---|--- 2026-04-23 23:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mk76czqxax2s...

CVE-2026-29198

creationtimestamp| type| source ---|---|--- 2026-04-23 21:25:36+00:00| published-proof-of-concept| Telegram/tS2ffuiIBjg-jG5ou8TlrNJjBU2OGhcKfhZwclhyaQjdHg 2026-06-03 04:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/87073 2026-06-03 09:00:04+00:00| seen|...

CVE-2026-35351

The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and...

CVE-2026-35362

The safetraversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use TOCTOU symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize...

CVE-2026-35361

The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::removedir, which cannot remove device nodes or FIFOs. This leaves mislabeled nodes behind wi...

CVE-2026-35346

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::fromutf8lossy, which replaces invalid UTF-8 byte sequences with the Unicode replacement character U+FFFD. This behavior differs from GNU comm, whic...