https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 19 Sep 2026 20:09:49 +0000 https://vulnerability.circl.lu/sighting/d6c580f4-9105-4379-a9a5-983f46ac7b72/export {"uuid": "d6c580f4-9105-4379-a9a5-983f46ac7b72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-m6c8-jcw2-5r25", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mvskcvaglu2g", "content": "https://github.com/advisories/GHSA-m6c8-jcw2-5r25\nevery release, changelog and advisory that matters, once a day by email: https://standup.thecompound.tech/sb/cnh53b", "creation_timestamp": "2026-09-18T16:05:29.887079Z"} {"uuid": "d6c580f4-9105-4379-a9a5-983f46ac7b72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-m6c8-jcw2-5r25", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mvskcvaglu2g", "content": "https://github.com/advisories/GHSA-m6c8-jcw2-5r25\nevery release, changelog and advisory that matters, once a day by email: https://standup.thecompound.tech/sb/cnh53b", "creation_timestamp": "2026-09-18T16:05:29.887079Z"} https://vulnerability.circl.lu/sighting/d6c580f4-9105-4379-a9a5-983f46ac7b72/export Fri, 18 Sep 2026 16:05:29 +0000 https://vulnerability.circl.lu/sighting/278b9dbe-286e-4592-aec4-963110ad77be/export {"uuid": "278b9dbe-286e-4592-aec4-963110ad77be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-m6c8-jcw2-5r25", "type": "seen", "source": "https://gist.github.com/alon710/a61fcfa28224e9a745d03ea7d19d70bf", "content": "# CVE-2026-77615: CVE-2026-77615: Stored Cross-Site Scripting (XSS) in Paella Player as used in Opencast\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-77615\n\n## Summary\nCVE-2026-77615 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability in the Paella Player component, which is integrated as the default front-end media viewer in Opencast. Unsafe client-side rendering of subtitle tracks allows authenticated, low-privileged users to inject arbitrary JavaScript payloads via crafted WebVTT or DFXP files. The script executes within the context of any viewer session under the host origin, enabling session hijacking and unauthorized API interaction.\n\n## TL;DR\nA Stored XSS vulnerability in Paella Player allows authenticated users to execute arbitrary JavaScript in the browsers of other users by uploading a crafted subtitle file.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79 (Improper Neutralization of Input During Web Page Generation)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 8.7 (High)\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n- **Impact**: Arbitrary Client-side Script Execution (Stored XSS)\n- **Affected Component**: CaptionsCanvas / DFXPParser / WebVTTParser\n\n## Affected Systems\n\n- polimediaupv paella-player < 2.12.11\n- polimediaupv paella-core < 1.50.5\n- opencast opencast < 19.7\n- opencast opencast >= 20.0, < 20.2\n- **paella-player**: < 2.12.11 (Fixed in: `2.12.11`)\n- **paella-core**: < 1.50.5 (Fixed in: `1.50.5`)\n- **opencast**: < 19.7 (Fixed in: `19.7`)\n- **opencast**: >= 20.0, < 20.2 (Fixed in: `20.2`)\n\n## Mitigation\n\n- Upgrade Paella Player and Opencast to patched versions\n- Implement Content Security Policy (CSP)\n- Enforce server-side sanitization on uploaded WebVTT and DFXP files\n\n**Remediation Steps:**\n1. Identify active instances of Opencast running versions below 19.7 or 20.2.\n2. Apply the corresponding upgrades to deploy Paella Player 2.12.11 and paella-core 1.50.5.\n3. Configure an HTTP response header to restrict resource execution: Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'.\n4. Verify that media assets do not contain unescaped html tags prior to execution in custom applications.\n\n## References\n\n- [Advisory on Stored XSS in Paella Player](https://github.com/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25)\n- [Opencast Pull Request 7736](https://github.com/opencast/opencast/pull/7736)\n- [Opencast Release 19.7](https://github.com/opencast/opencast/releases/tag/19.7)\n- [Opencast Release 20.2](https://github.com/opencast/opencast/releases/tag/20.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-77615) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T14:31:27.713090Z"} {"uuid": "278b9dbe-286e-4592-aec4-963110ad77be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-m6c8-jcw2-5r25", "type": "seen", "source": "https://gist.github.com/alon710/a61fcfa28224e9a745d03ea7d19d70bf", "content": "# CVE-2026-77615: CVE-2026-77615: Stored Cross-Site Scripting (XSS) in Paella Player as used in Opencast\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-77615\n\n## Summary\nCVE-2026-77615 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability in the Paella Player component, which is integrated as the default front-end media viewer in Opencast. Unsafe client-side rendering of subtitle tracks allows authenticated, low-privileged users to inject arbitrary JavaScript payloads via crafted WebVTT or DFXP files. The script executes within the context of any viewer session under the host origin, enabling session hijacking and unauthorized API interaction.\n\n## TL;DR\nA Stored XSS vulnerability in Paella Player allows authenticated users to execute arbitrary JavaScript in the browsers of other users by uploading a crafted subtitle file.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79 (Improper Neutralization of Input During Web Page Generation)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 8.7 (High)\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n- **Impact**: Arbitrary Client-side Script Execution (Stored XSS)\n- **Affected Component**: CaptionsCanvas / DFXPParser / WebVTTParser\n\n## Affected Systems\n\n- polimediaupv paella-player < 2.12.11\n- polimediaupv paella-core < 1.50.5\n- opencast opencast < 19.7\n- opencast opencast >= 20.0, < 20.2\n- **paella-player**: < 2.12.11 (Fixed in: `2.12.11`)\n- **paella-core**: < 1.50.5 (Fixed in: `1.50.5`)\n- **opencast**: < 19.7 (Fixed in: `19.7`)\n- **opencast**: >= 20.0, < 20.2 (Fixed in: `20.2`)\n\n## Mitigation\n\n- Upgrade Paella Player and Opencast to patched versions\n- Implement Content Security Policy (CSP)\n- Enforce server-side sanitization on uploaded WebVTT and DFXP files\n\n**Remediation Steps:**\n1. Identify active instances of Opencast running versions below 19.7 or 20.2.\n2. Apply the corresponding upgrades to deploy Paella Player 2.12.11 and paella-core 1.50.5.\n3. Configure an HTTP response header to restrict resource execution: Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'.\n4. Verify that media assets do not contain unescaped html tags prior to execution in custom applications.\n\n## References\n\n- [Advisory on Stored XSS in Paella Player](https://github.com/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25)\n- [Opencast Pull Request 7736](https://github.com/opencast/opencast/pull/7736)\n- [Opencast Release 19.7](https://github.com/opencast/opencast/releases/tag/19.7)\n- [Opencast Release 20.2](https://github.com/opencast/opencast/releases/tag/20.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-77615) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T14:31:27.713090Z"} https://vulnerability.circl.lu/sighting/278b9dbe-286e-4592-aec4-963110ad77be/export Fri, 18 Sep 2026 14:31:27 +0000