How severe is CVE-2026-42156?

CVE-2026-42156 has a CVSS 4.0 base score of 7.1, rated high severity.

Is CVE-2026-42156 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-42156?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-42156 have an EU (EUVD) identifier?

Yes. CVE-2026-42156 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-29873.

When was CVE-2026-42156 published?

CVE-2026-42156 was published on 2026-05-12 and last updated on 2026-06-17.

CVE-2026-42156

CVE-2026-42156 is a high-severity vulnerability with a CVSS 4.0 base score of 7.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-943.

Key facts

Severity: High (CVSS 4.0 base score 7.1)
EPSS exploit prediction: 0% (20th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-29873
Weakness: CWE-943
Published: 2026-05-12
Last modified: 2026-06-17

Description

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote attacker can create a node with a malicious type that can escape an existing Cypher query and an adversary can execute an arbitrary Cypher query. This vulnerability is fixed in 1.2.3.

Frequently asked questions

What is CVE-2026-42156?: Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote attacker can create a node with a malicious type that can escape an existing Cypher query and an adversary can execute an arbitrary Cypher query. This vulnerability is fixed in 1.2.3.
How severe is CVE-2026-42156?: CVE-2026-42156 has a CVSS 4.0 base score of 7.1, rated high severity.
Is CVE-2026-42156 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-42156?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-42156 have an EU (EUVD) identifier?: Yes. CVE-2026-42156 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-29873.
When was CVE-2026-42156 published?: CVE-2026-42156 was published on 2026-05-12 and last updated on 2026-06-17.

References

https://github.com/reconurge/flowsint/security/advisories/GHSA-h5m2-c2c5-968p

Other CWE-943 vulnerabilities

CVE-2026-40141 — Critical (CVSS 9.9): A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote…
CVE-2024-4872 — Critical (CVSS 9.9): A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an…
CVE-2026-41274 — Critical (CVSS 9.8): Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the…
CVE-2026-40351 — Critical (CVSS 9.8): FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses…
CVE-2026-32248 — Critical (CVSS 9.8): Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to…
CVE-2026-29793 — Critical (CVSS 9.8): Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0…

Browse all CWE-943 vulnerabilities →