CVE-2026-77166

LowCVSS 2.4/10Last modified Sep 22, 2026

Description

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

Metrics

CVSS 3.0 2.4/10CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-840

Affected software

Vendor	Product	Versions
Nextcloud	Collectives	>= 3.2.1, <= 3.5.0

References

Timeline

Published: Sep 21, 2026
Last modified: Sep 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-771677.5Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist ind CVE-2026-771684.3A cross-site request forgery vulnerability in tracker-invocation.php in Revive Adserver 6.0.8 and earlier allows an attacker to modify a tra CVE-2026-771696.5A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only deleg CVE-2026-77178.8A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. This issue affects the function UploadCustomModule of the file /cgi-b CVE-2026-771704.3The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the CVE-2026-771713.5A public shared collective always allowed recipients of the link to create pages.CVE-2026-771725.3App passwords were allowed to bypass password confirmation on sensitive endpoints.CVE-2026-771734.3A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not b CVE-2026-771768.1A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host op CVE-2026-771779.8Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prom CVE-2026-771789.1Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp CVE-2026-771799.4On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path.