Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent can attempt a best-effort scan of the archive bytes. Version 1.21.0 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28407 malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nes… https://www.cve.org/CVERecord?id=CVE-2026-28407
Post summary
The post references CVE-2026-28407 and mentions the malcontent tool, but it provides no details on exploitation, patches, or technical specifics.
CVE-2026-28407 Malcontent Supply-Chain Compromise Discovery Tool Vulnerability P... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28407 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
A brief mention of CVE-2026-28407 with a link to vulmon.com for details; no additional information about PoC, exploitation, patches, or technical specifics is provided.
CVE-2026-28407: Malcontent Logic Error: Nested Archive Deletion Allows Detection Bypass A logic vulnerability in the `malcontent` supply chain security tool allows attackers to bypass detection engines. The issue resides in the handling of nested arch... https://cvereports.com/reports/CVE-2026-28407
Post summary
The post highlights a logic flaw in Malcontent’s nested‑archive handling that could bypass detection engines, but no PoC, exploit code, active usage, or patch information is included.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | chainguard | malcontent | - | - | - |