CVE-2026-19912

The Kaltura HTML5 player (mwEmbed / html5lib) is affected by an unauthenticated remote code execution vulnerability rooted in two compounding flaws: unsafe deserialization of a user-controlled ServiceUrl response via unserialize() in mwEmbedLoader.php, and unsanitized filesystem path construction...