CVE-2026-19913

CVE-2026-19913 affects the Kaltura HTML5 player (mwEmbed / html5lib), where improper validation of the ServiceUrl parameter in mwEmbedLoader.php allows non-HTTP schemes such as file://. When a backend request triggered by this parameter raises an exception, the raw response is deserialized and re...

EUVD-2026-65614

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...