Axios sits underneath LangChain, OpenAI's SDK, dozens of MCP clients, ...
It's npm account got hijacked and published two backdoored versions!
If you are in AI agent deployments, see What You Should Do Right Now:
https://mistaike.ai/blog/axios-npm-supply-chain/

Quote:
https://mastodon.social/@mistaike/116334359828804865

#InfoSec #CyberSecurity #SupplyChain #AIAgent #MCPProtocol

Vim's Partial Patch Problem: 14+ Heap Overflows Left Behind After CVE-2026-28421

One (int) cast was fixed. At least 14 identical truncations remain across ex_getln.c, memline.c, terminal.c, session.c and others.

size_t → (int) cast silently truncates values > INT_MAX → undersized alloc → heap buffer overflow (CWE-190 → CWE-122).

Trigger vectors: swap files, undo files, session files, terminal output — all accessible via shared filesystems and repos.

Vim's lead maintainer closed the GitHub Security Advisory and threatened to ban the reporter.

The fix is trivial: remove the redundant (int) casts. alloc() already accepts size_t.

Full writeup: https://medium.com/@engningarchitect/vims-partial-patch-problem-14-heap-overflows-left-behind-after-cve-2026-28421-95c3b6863642

#vim #infosec #CVE #heapoverflow #vulnerability #opensource

🚨 EUVD-2026-18170

📊 Score: 6.9/10 (CVSS v3.1)
📦 Product: Mongoose, Mongoose, Mongoose (+19 more)
🏢 Vendor: Cesanta
📅 Updated: 2026-04-02

📝 A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based bu...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-18170

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-18165

📊 Score: 6.3/10 (CVSS v3.1)
📦 Product: Secure Email Gateway
🏢 Vendor: SEPPmail
📅 Updated: 2026-04-02

📝 SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to forge a GINA-encrypted email.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-18165

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-18166

📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Secure Email Gateway
🏢 Vendor: SEPPmail
📅 Updated: 2026-04-02

📝 SEPPmail Secure Email Gateway before version 15.0.3 does not properly authenticate the inner message of S/MIME-encrypted MIME entities, allowing an attacker to control trusted headers.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-18166

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-18168

📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Secure Email Gateway
🏢 Vendor: SEPPmail
📅 Updated: 2026-04-02

📝 SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge security tags using Unicode lookalike characters.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-18168

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-18160

📊 Score: 7.7/10 (CVSS v3.1)
📦 Product: Secure Email Gateway
🏢 Vendor: SEPPmail
📅 Updated: 2026-04-02

📝 SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to cause attacker-controlled certificates to be used for future encryption to a victim by adding the certificates to S/MIME signatures.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-18160

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-18162

📊 Score: 7.7/10 (CVSS v3.1)
📦 Product: Secure Email Gateway
🏢 Vendor: SEPPmail
📅 Updated: 2026-04-02

📝 SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge tags such as [signed OK].

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-18162

#cybersecurity #infosec #euvd #cve #vulnerability