OCTOBER 12, 2026
Live Feed
Back to database
Case File

CVE-2026-77615

HIGH · CVSS 8.7 EPSS 0.56% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-17 · Last synced 2026-10-12

CyberRota Analysis

AI-Generated

The vulnerability affects Paella Player versions prior to 2.12.11, which is utilized in Opencast versions before 19.7 and 20.2, allowing for potential cross-site scripting (XSS) attacks through closed captions cue text. This could lead to unauthorized script execution in the context of the user’s browser, posing a significant security risk. Organizations using affected versions of Paella Player should prioritize upgrading to the patched version to mitigate this high-severity threat.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-77615
Severity
HIGH
CVSS
8.7
EPSS
0.56%

Original NVD Description

Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11.