CVE-2026-19912

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

CVE-2026-19912

CVE-2026-19912 is an unauthenticated remote code execution vulnerability in the Kaltura HTML5 Player V2 library (mwEmbed / html5lib). The root cause is an unsafe PHP unserialize() call in KalturaClientBase.php combined with unsanitized use of the uiconf_id parameter in cache path construction, al...