CVE-2026-77166

LowCVSS 2.4/10Last modified Sep 22, 2026

Description

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

Metrics

CVSS 3.0 2.4/10CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-840

Affected software

No affected versions have been published.

Timeline

Published
Sep 21, 2026
Last modified
Sep 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-771696.5A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegCVE-2026-77178.8A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. This issue affects the function UploadCustomModule of the file /cgi-bCVE-2026-771704.3The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether theCVE-2026-771768.1A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host opCVE-2026-771779.8Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because promCVE-2026-771789.1Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cppCVE-2026-771799.4On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path.CVE-2026-77186.3A vulnerability was identified in Totolink WA300 5.2cu.7112_B20190227. Impacted is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cCVE-2026-771808.3When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGCVE-2026-771819.8Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the reCVE-2026-771838.8The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all veCVE-2026-771845.2In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL r