CVE-2026-42156: falha de alta gravidade em reconurge flowsint
Flowsint: Cypher query injection in node type on node creation
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.3%
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote attacker can create a node with a malicious type that can escape an existing Cypher query and an adversary can execute an arbitrary Cypher query. This vulnerability is fixed in 1.2.3.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
reconurge · flowsintCVEs relacionadas — reconurge flowsint
No mesmo produto, das mais perigosas para as menos.
CVE-2026-32311CRITICALCommand Injection and Docker container escape allows root on host machineEPSS 0.5%CVE-2026-42157MEDIUMFlowsint: Stored XSS on map node marker in map pageEPSS 0.3%CVE-2026-44352MEDIUMFlowsint: Broken Access Control allows reading of sketch logs from any userEPSS 0.3%CVE-2026-42158LOWFlowsint: Broken Access Control allows modification of investigation metadata from any userEPSS 0.2%CVE-2026-42159MEDIUMFlowsint: Stored XSS in description of nodeEPSS 0.2%