Two unpatched vulnerabilities in Kaltura's mwEmbed HTML5 player library (html5lib) allow unauthenticated file read and remote code execution via insecure deserialization in mwEmbedLoader.php. CVE-2026-19913 and CVE-2026-19912 affect any exposed instance with no auth or tokens required. No vendor patch exists yet.
#Kaltura #VulnerabilityManagement #RCE #CERTCC
https://cyberworldops.eu/en/unpatched-kaltura-player-vulnerabilities-expose-files-and-allow-code