CVE-2026-77166

2.4 lowEPSS 0.3%

Low (2.4). EPSS 0.3% chance of exploitation in the next 30 days.

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

Severity

CVSS 3.0

2.4 low

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE: CWE-840
Published: 2026-09-21
Modified: 2026-09-22
Record from: the NVD, synced 2026-10-19

References

https://hackerone.com/reports/3599470
https://hackerone.com/reports/3599470

Check your stack JSON