SecOne4allLoading…
S1SecOne4all
Join free
CVE✓ EDITORIALLY REVIEWED

CVE-2026-77166: The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide othe

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

NNVD CVE APIOriginal reporting source
1 min read

Source summary

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

Read the original report

Source transparency

This editorial summary links back to the original reporting. Review the source for its complete context and updates.

Open original report ↗
Continue reading
More verified coverage
CVE · Sep 21, 2026 · 06:36 PM · UTC · UTC+00:00CVE-2026-36469: CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionality).

CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionality).

Read article →CVE · Sep 21, 2026 · 06:36 PM · UTC · UTC+00:00CVE-2026-77165: File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

Read article →CVE · Sep 21, 2026 · 06:34 PM · UTC · UTC+00:00CVE-2026-84298: Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownership is verified, and callback delivery resolves that map by task UUID without tenant identity. An authenticated tenant worker that knows another tenant's durable task UUID and keeps a stream open on the same dispatcher process can receive that

Read article →