Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code

The CERT Coordination Center CERT/CC has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library that allow a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it. The flaws, tracked as CVE-2026-19913 and CVE-2026-19912 , both stem...

log4j-4255

log4j2 4255 — FilteredObjectInputStream allowlist bypass vi...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a deserialization vulnerability due to PLY (Python Lex-Yacc)

Summary PLY Python Lex-Yacc is used by IBM Integrated Analytics System as a Python parsing library implementing lex and yacc tools. CVE-2025-56005 affects PLY version 3.11 due to deserialization of untrusted data CWE-502. This critical vulnerability could allow a remote attacker, without any...

bank-api-remediated

vulnbank-api — Remediated Fixed version of bank-api, built...

Linux Distros Unpatched Vulnerability : CVE-2026-79657

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific...

PT-2026-82351

Name of the Vulnerable Software and Affected Versions Spring Integration version 7.1.0 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 5.5.21 and earlier Description JSON ...

PT-2026-82214

Name of the Vulnerable Software and Affected Versions ILIAS affected versions not specified Description An unauthenticated caller can trigger the deserialization of stored session data. The Shibboleth back-channel endpoint 'components/ILIAS/AuthShibboleth/resources/shib logout.php' operates in a...

Ajax.NET Professional Deserialization of Untrusted Data Vulnerability

Ajax.NET Professional AjaxPro contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users are advised to discontinue use and/or transition to a...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the JWE.deserialize method jwcrypto/jwe.py:555, which calls rawjwe.split'.' on the input before checking that the compact serialization has the required five segments . An attacker...

EUVD-2026-37015

gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads...

CVE-2026-19912

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

EUVD-2026-65614

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

CVE-2026-19912

The Kaltura HTML5 player (mwEmbed / html5lib) is vulnerable to unauthenticated remote code execution (RCE) in versions html5lib v2.45, v2.103, and earlier , as well as other v2.x releases. The root cause is unsafe data deserialization via the mwEmbedLoader.php endpoint, which processes a user-con...

CVE-2026-19912 CVE-2026-19912

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

CVE-2026-19912 CVE-2026-19912

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

CVE-2026-79785 X-AnyLabeling before 4.0.0-beta.9 Improper Certificate Validation in Model Downloads

X-AnyLabeling's model downloader disabled TLS certificate verification. downloadwithretry in anylabeling/services/autolabeling/model.py built a context with ssl.createunverifiedcontext and passed it to urllib.request.urlopen, so neither the certificate chain nor the hostname was checked on any...

USN-8675-1 perl vulnerabilities

It was discovered that Perl incorrectly handled short source addresses in the Socket module. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. CVE-2026-12087 It was discovered that Perl incorrectly handled regular expressions...

Deserialization of Untrusted Data

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in nltk.picklesec.AllowlistUnpickler, nltk.tokenize.punkt.punktpickleload, and...

PYSEC-2026-3735

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer.execute and...

CVE-2026-79657

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer.execute and...