CVE Feed

    Dashboard / CVE / CVE-2026-77615

    CVE-2026-77615

    Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11.

    Published:Sep 17, 2026
    Last Modified:Sep 22, 2026
    EPS:Sep 17, 2026
    EPSS Score:0.00392
    CVSS Score:8.7

    Affected Products

    Vendor
    Opencast
    Product
    Opencast
    Vendor
    Polimediaupv
    Product
    Paella-player

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-77614 (CVSS 8.8) — Opencast is a free, open-source platform to support the management of educational audio and video content. Pri…
    CVE-2025-61906 (CVSS 2.3) — Opencast is a free, open-source platform to support the management of educational audio and video content. Pri…
    CVE-2025-61788 (CVSS 5.1) — Opencast is a free, open-source platform to support the management of educational audio and video content. Pri…
    CVE-2025-55202 (CVSS 2.7) — Opencast is a free, open-source platform to support the management of educational audio and video content. In …
    CVE-2025-54380 (CVSS 6.5) — Opencast is a free, open-source platform to support the management of educational audio and video content. Pri…
    CVE-2024-52797 (CVSS 6.5) — Opencast is free and open source software for automated video capture and distribution. First noticed in Openc…
    CVE-2017-1000217 (CVSS 8.8) — Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player…

    References

    https://github.com/opencast/opencast/commit/701682c635f668228c3e8fb7b4564b3294788e40
    https://github.com/opencast/opencast/pull/7736
    https://github.com/opencast/opencast/releases/tag/19.7
    https://github.com/opencast/opencast/releases/tag/20.2
    https://github.com/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25
    https://github.com/polimediaupv/paella-core/commit/94a36490808ac5a1f60a0745d71ec9253f6d206b
    https://github.com/polimediaupv/paella-core/commit/9b2f14ec4cf55efaf4c045c77a5ed8f5ec559ab4
    https://github.com/polimediaupv/paella-player/blob/a1b6c42467938a00a4b4d0b8c68435cd4f9d2a16/repos/paella-core/CHANGELOG.md?plain=1#L21
    https://github.com/polimediaupv/paella-player/commit/6fe4af7306044198c8e91e2e7f4128428b83cf03
    https://github.com/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High