PT-2026-22408 · Unknown · Malcontent

1Seal · Publicado 2026-02-27 · Atualizado 2026-03-25 · CVE-2026-28407

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions malcontent versions prior to 1.21.0

Description malcontent is software designed for identifying supply-chain compromises using context, differential analysis, and YARA. Before version 1.21.0, the software removed nested archives that failed to extract, potentially allowing malicious content to remain undetected. The issue is addressed by preserving these archives to enable a best-effort scan of the archive bytes.

Recommendations Update to version 1.21.0 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-703

Identificadores relacionados

CVE-2026-28407

GHSA-945P-3JHM-6RCP

GO-2026-4577

SUSE-SU-2026:1042-1

Produtos afetados

Malcontent

Referências · 141

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28407.json · Exploit
• https://github.com/chainguard-dev/malcontent/commit/356c56659ccfcad0b249a97de8cf71f151ed3ee9 · Correção
• https://github.com/chainguard-dev/malcontent/pull/1383 · Correção
• https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-945p-3jhm-6rcp · Aviso do Fabricante
• https://github.com/chainguard-dev/malcontent · Nota
• https://suse.com/security/cve/CVE-2026-29191 · Nota
• https://suse.com/security/cve/CVE-2026-28790 · Nota
• https://suse.com/security/cve/CVE-2026-31959 · Nota
• https://suse.com/security/cve/CVE-2026-29042 · Nota
• https://suse.com/security/cve/CVE-2026-28492 · Nota
• https://suse.com/security/cve/CVE-2026-25963 · Nota
• https://suse.com/security/cve/CVE-2026-27896 · Nota
• https://suse.com/security/cve/CVE-2026-29773 · Nota
• https://suse.com/security/cve/CVE-2026-30934 · Nota
• https://suse.com/security/cve/CVE-2026-30855 · Nota