What is CVE-2026-42156?
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote attacker can create a node with a malicious type that can escape an existing Cypher query and an adversary can execute an arbitrary Cypher query. This vulnerability is fixed in 1.2.3.
Timeline
- 2026-05-12Published to the U.S. National Vulnerability Database (NVD)
- 2026-06-17NVD record last updated
Affected product
See advisory
Remediation Steps
- Immediately disable Funnel Builder plugin on all WooCommerce installations until patched
- Review WooCommerce checkout page JavaScript for malicious code injection
- Audit payment processing logs for unauthorized transactions in the past 60 days
- Reset customer payment tokens and notify affected customers of potential exposure
- Update plugin to patched version when released and re-enable with security scanning
References
Referenced in our briefings & reports
- Vulnerability Priority Report – Week 3 of May 2026 (May 18 – 24)
Browse all tracked CVEs in the defend.network CVE database →
🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.