CVE-2026-42159

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Flowsint allows a user to create investigations, which are used to manage sketches and analyses. Sketches have controllable graphs, which are comprised of nodes and relationships. The sketches contain information on an OSINT target (usernames, websites, etc) within these nodes and relationships. A remote attacker can create a node with a malicious description that contains arbitrary HTML. When the node is selected, it will render the arbitrary HTML, potentially triggering stored XSS. This vulnerability is fixed in 1.2.3.

• CWE-79

• https://github.com/reconurge/flowsint/security/advisories/GHSA-w233-5mmx-cr7xExploit, Vendor Advisory
• https://github.com/reconurge/flowsint/security/advisories/GHSA-w233-5mmx-cr7xExploit, Vendor Advisory

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42153Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-42154Prometheus is an open-source monitoring system and time seri…7.5
• CVE-2026-42155Magento Long Term Support (LTS) is an unofficial, community-…9.3
• CVE-2026-42156Flowsint is an open-source OSINT graph exploration tool desi…7.1
• CVE-2026-42157Flowsint is an open-source OSINT graph exploration tool desi…5.1
• CVE-2026-42158Flowsint is an open-source OSINT graph exploration tool desi…2.3
• CVE-2026-4216A weakness has been identified in i-SENS SmartLog App up to …5.3
• CVE-2026-42160Data Space Portal is an open-source Software as a Service (S…10
• CVE-2026-42167mod_sql in ProFTPD before 1.3.9a allows remote attackers to …8.1
• CVE-2026-42168django-pyas2 through 1.2.3 is vulnerable to OS command injec…9.1
• CVE-2026-42169A heap-buffer-overflow vulnerability exists in the APNG (Ani…7.3
• CVE-2026-4217A security vulnerability has been detected in XREAL Nebula A…2.5