The most featured CVEs in this week’s security newsletters, with public Proof-of-Concepts, ordered by mention count.

For the most up-to-date and accurate info, visit the NIST links. Always audit PoCs thoroughly before running them. I don’t vouch for any links in this list: follow them with caution.

CVE-2026-31431 NEW

• Severity: 7.8 HIGH
• Impacted Products: All major Linux distros since 2017
• Description: This local privilege escalation is rated as Important severity. Part of the Linux kernel’s cryptographic interface contains an incorrect in-place operation, where source and destination data mappings differ. This could lead to data integrity issues, including the escalation to root privileges.
• Remediation:
  • crypto: algif_aead - Revert to operating out-of-place
  • oss-security - CVE-2026-31431: CopyFail: linux local privilege scalation
  • oss-security - Re: CVE-2026-31431: CopyFail: linux local privilege scalation
• More Info: NVD - CVE-2026-31431
• PoC:
  • https://github.com/mCub3/CVE-2026-31431
  • https://github.com/Theori-lO/copy-fail-CVE-2026-31431
  • https://github.com/ruattd/cve-2026-31431

CVE-2026-41940 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: cPanel and WHM versions after 11.40
• Description: cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-41940
• PoC:
  • https://github.com/Jenderal92/CVE-2026-41940
  • https://github.com/merdw/cPanel-CVE-2026-41940-Scanner
  • https://github.com/0xBlackash/CVE-2026-41940

CVE-2026-33634

• Severity: 8.8 HIGH
• Impacted Products: Aqua Security Trivy v0.69.4, aquasecurity/trivy-action (versions 0.0.1 – 0.34.2), aquasecurity/setup-trivy (versions 0.2.0 – 0.2.6)
• Description: Aqua Security Trivy and its associated GitHub Actions were affected by a supply chain compromise where a threat actor published malicious releases containing embedded malware. This incident allowed for the execution of credential-stealing code within environments using the affected software.
• Remediation:
  • Security Update: Suspected Supply Chain Incident | liteLLM
  • [Security]: litellm PyPI package (v1.82.7 + v1.82.8) compromised — full timeline and status · Issue #24518 · BerriAI/litellm · GitHub
  • Trivy Security incident 2026-03-19 · aquasecurity/trivy · Discussion #10425 · GitHub
• More Info: NVD - CVE-2026-33634
• PoC:
  • https://github.com/fevar54/CVE-2026-33634-Scanner

CVE-2026-41679 NEW

• Severity: 10.0 CRITICAL
• Impacted Products: Paperclip, prior to version 2026.416.0
• Description: Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in authenticated mode with default configuration. No user interaction, no credentials, just the target’s address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default depl…
• Remediation:
  • Unauthenticated Remote Code Execution via Import Authorization Bypass · Advisory · paperclipai/paperclip · GitHub
• More Info: NVD - CVE-2026-41679
• PoC:
  • https://github.com/bartfroklage/cve-2026-41679

CVE-2026-41651 NEW

• Severity: 8.8 HIGH
• Impacted Products: PackageKit
• Description: PackageKit is affected by a time-of-check time-of-use (TOCTOU) race condition vulnerability that allows a local unprivileged user to escalate privileges to root. This flaw exists due to improper synchronization and validation of transaction flags within the D-Bus abstraction layer.
• Remediation:
  • Important: PackageKit security update
  • Important: PackageKit security update
  • oss-security - CVE-2026-41651: TOCTOU vulnerability in PackageKit <= 1.3.4 leads to local root exploit
• More Info: NVD - CVE-2026-41651
• PoC:
  • https://github.com/CipherCloak/CVE-2026-41651
  • https://github.com/baph00met/CVE-2026-41651
  • https://github.com/0xBlackash/CVE-2026-41651

CVE-2026-3854 NEW

• Severity: 8.8 HIGH
• Impacted Products: GitHub Enterprise Server
• Description: GitHub Enterprise Server is affected by a command injection vulnerability that allows an authenticated attacker with push access to a repository to achieve remote code execution. This issue stems from the improper neutralization of special elements within Git push options during internal service communication.
• Remediation:
  • Release notes - GitHub Enterprise Server 3.14 Docs
  • Release notes - GitHub Enterprise Server 3.14 Docs
  • Release notes - GitHub Enterprise Server 3.14 Docs
• More Info: NVD - CVE-2026-3854
• PoC:
  • https://github.com/simondankelmann/cve-2026-3854-test
  • https://github.com/5kr1pt/CVE-2026-3854
  • https://github.com/LACHHAB-Anas/Exploit_CVE-2026-3854

CVE-2026-33656 NEW

• Severity: 9.1 CRITICAL
• Impacted Products: EspoCRM, prior to version 9.3.4
• Description: EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM’s built-in formula scripting engine allowing updating attachment’s sourceId thus allowing an authenticated admin to overwrite the sourceId field on Attachment entities. Because sourceId is concatenated directly into a file path with no sanitization in EspoUploadDir::getFilePath(), an attacker can redirect any file read or write operation to an arbitrary path within the web server’s …
• Remediation:
  • Authenticated RCE via Formula with path traversal in attachment sourceId, exploitable by admin user · Advisory · espocrm/espocrm · GitHub
• More Info: NVD - CVE-2026-33656
• PoC:
  • https://github.com/JivaSecurity/ESPOCRM-RCE-POC-CVE-2026-33656

CVE-2024-46636 NEW

• Severity: 9.4 CRITICAL
• Impacted Products: NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1
• Description: NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection vulnerability in the category parameter
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2024-46636
• PoC:
  • https://github.com/NU1L0/CVE-2024-46636-SQLi-MODAPS

CVE-2026-21852 NEW

• Severity: 7.5 HIGH
• Impacted Products: Claude Code 2.0.65
• Description: Claude Code, an agentic coding tool for Node.js developed by Anthropic, is affected by an information disclosure vulnerability in versions prior to 2.0.65 that allows malicious repositories to exfiltrate sensitive data, including Anthropic API keys. This issue occurs because the application processes project-level configuration settings and initiates network requests before the user is prompted to trust the repository.
• Remediation:
  • Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation
  • Malicious repo configuration can trigger data leakage via environment configuration used before trust confirmation · Advisory · anthropics/claude-code · GitHub
• More Info: NVD - CVE-2026-21852
• PoC:
  • https://github.com/atiilla/CVE-2026-21852-PoC

CVE-2025-68664 NEW

• Severity: 8.2 HIGH
• Impacted Products: langchain-core
• Description: LangChain is affected by a serialization injection vulnerability in the langchain-core library’s dumps() and dumpd() functions. This flaw allows an attacker to craft malicious data that is misinterpreted as a legitimate internal object during deserialization.
• Remediation:
  • Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
  • Red Hat Ansible Automation Platform 2.4 Container Release Update
  • Red Hat Ansible Automation Platform 2.6 Container Release Update
• More Info: NVD - CVE-2025-68664
• PoC:
  • https://github.com/langchain-ai/langchain/pull/34455/files
  • https://www.exploit-db.com/exploits/52514

References

This list was scraped from the quite amazing and highly recommended newsletters below:

• ~this week in security~
• Unsupervised Learning
• @RISK
• Hive Five
• Vulnerable U
• tl;dr sec

Thanks for reading! For corrections, omissions (e.g. newsletter recs) feel free to get in touch.