CVE-2026-4357 Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites...

PT-2026-84724

Name of the Vulnerable Software and Affected Versions Embed HTML5 Game WordPress plugin versions prior to 1.4 Description The plugin fails to properly restrict file upload permissions and the types of files that can be uploaded. This allows unauthenticated attackers to upload arbitrary files, suc...

CVE-2026-4357: Unrestricted Upload of File with Dangerous Type

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites...

CVE-2026-19913

A flaw was found in the Kaltura HTML5 player mwEmbed / html5lib. An unauthenticated, remote attacker can exploit improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter, used for backend requests, accepts non-HTTP schemes such as file://. When an exception or error...

Linux Distros Unpatched Vulnerability : CVE-2026-19913

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in...

EUVD-2026-65615

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

CVE-2026-19913 CVE-2026-19913

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

CVE-2026-19913 CVE-2026-19913

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

CVE-2026-19912 CVE-2026-19912

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

CVE-2026-19912 CVE-2026-19912

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

PT-2026-81395

Name of the Vulnerable Software and Affected Versions Kaltura HTML5 player mwEmbed / html5lib versions 2.x and earlier Description A local file disclosure issue exists due to improper validation of the ServiceUrl parameter in the 'mwEmbedLoader.php' endpoint. This parameter, intended as the base...

PT-2026-81394

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

CVE-2026-19913: Improper Input Validation

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

CVE-2026-19912: Improper Input Validation

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

CVE-2026-54743

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...

CVE-2026-54743 Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...

CVE-2026-54743 Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...

CVE-2026-54743 Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...

CVE-2026-54743

Lemmy (a fediverse link aggregator and forum) is affected by a stored XSS in lemmy-ui prior to version 0.19.19-beta.1 . The root cause lies in src/shared/markdown.ts, where mdToHtml returns a raw __html object injected by Inferno without a sanitizer pass. The [email protected] plugin,...

CVE-2026-54743: Improper Neutralization of Input During Web Page Generation

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...