CVE-2026-19913

CVE-2026-19913 affects the Kaltura HTML5 player (mwEmbed / html5lib), where improper validation of the ServiceUrl parameter in mwEmbedLoader.php allows non-HTTP schemes such as file://. When a backend request triggered by this parameter raises an exception, the raw response is deserialized and re...