CVE-2026-19913

A flaw was found in the Kaltura HTML5 player mwEmbed / html5lib. An unauthenticated, remote attacker can exploit improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter, used for backend requests, accepts non-HTTP schemes such as file://. When an exception or error...

Linux Distros Unpatched Vulnerability : CVE-2026-19913

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in...

Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code

The CERT Coordination Center CERT/CC has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library that allow a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it. The flaws, tracked as CVE-2026-19913 and CVE-2026-19912 , both stem...

CVE-2026-19913

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

CVE-2026-19912

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

EUVD-2026-65615

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

CVE-2026-19913 CVE-2026-19913

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

CVE-2026-19913

The Kaltura HTML5 player (mwEmbed / html5lib) is vulnerable to local file disclosure in versions v2.45, v2.103 and earlier , and other v2.x releases. The root cause is the improper validation of the ServiceUrl parameter in mwEmbedLoader.php, which accepts non-HTTP schemes like file://. Due to an ...

CVE-2026-19913 CVE-2026-19913

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

EUVD-2026-65614

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

CVE-2026-19912

The Kaltura HTML5 player (mwEmbed / html5lib) is vulnerable to unauthenticated remote code execution (RCE) in versions html5lib v2.45, v2.103, and earlier , as well as other v2.x releases. The root cause is unsafe data deserialization via the mwEmbedLoader.php endpoint, which processes a user-con...

CVE-2026-19912 CVE-2026-19912

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

CVE-2026-19912 CVE-2026-19912

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

PT-2026-81395

Name of the Vulnerable Software and Affected Versions Kaltura HTML5 player mwEmbed / html5lib versions 2.x and earlier Description A local file disclosure issue exists due to improper validation of the ServiceUrl parameter in the 'mwEmbedLoader.php' endpoint. This parameter, intended as the base...

PT-2026-81394

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Overview The Kaltura HTML5 Player V2 Library mwEmbed / html5lib contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code execution. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases tha...

CVE-2026-19913: Improper Input Validation

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

CVE-2026-19912: Improper Input Validation

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

Malicious Package

Overview kaltura-ngx-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-2605 Malicious code in kaltura-ngx-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33934fb6026f53c4e012992591edb1038036a17c485afca8e8fb3e40083a44ce The package kaltura-ngx-client was found to contain malicious code. Source: ghsa-malware...