HIGHCVSS 8.7EPSS 0.4%

CVE-2026-77615

CVE-2026-77615 updated by NVD

Published: 2026-09-18
Modified: 2026-09-20
EPSS percentile: 33%
Sources: github-advisory, nvd

Summary

Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Maven	org.opencastproject:opencast-engage-paella-player-7	—	19.7, 20.2
npm	paella-core	—	1.50.6

Remediation: Upgrade to 19.7 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-77615

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.