Find notable cyber news and cases, enriched with sources, timelines, and signals.

Kaltura mwEmbedLoader unsafe deserialization flaws (multiple vulnerabilities)

Vulnerability
First reported
Last updated
Happening score
H score 37
1 unique sources, 1 articles

Summary

Hide ▲

CERT/CC disclosed two unpatched Kaltura mwEmbedLoader vulnerabilities, CVE-2026-19913 and CVE-2026-19912, that expose html5lib v2.45, v2.103 and earlier to remote unauthenticated file read and code execution risk. The flaws affect the mwEmbedLoader.php endpoint and can reach both customer installations and shared multi-tenant hosts. No patch is available, so administrators have to rely on access restriction and input hardening.

Related Happenings

Kaltura mwEmbedLoader.php access restrictions and ServiceUrl allow-list guidance

Advisory/Mitigation
H score43 First: 26.08.2026 14:55 Last: 26.08.2026 14:55 Sources 1

How related: Administrators are advised to restrict or disable external access to the endpoint and to enforce a strict allow-list for the ServiceUrl parameter that permits only legitimate backend API URLs.

About this happening: CERT/CC issued mitigation guidance for exposed Kaltura mwEmbedLoader.php deployments to reduce risk from the unpatched deserialization flaws. Administrators were told...

Magento PolyShell mitigation guidance

Advisory/Mitigation
H score29 First: 20.03.2026 11:30 Last: 20.03.2026 11:30 Sources 1

About this happening: Sansec issued mitigation guidance for Magento storefronts after identifying a critical REST API file-upload flaw that can enable remote code execution or acc...

Timeline

  1. 26.08.2026 14:55 2 articles · 3h ago

    CERT/CC discloses unpatched Kaltura mwEmbedLoader file-read and code-execution flaws

    Technical Analysis Update

    CERT/CC disclosed two unpatched Kaltura HTML5 video player vulnerabilities, CVE-2026-19913 and CVE-2026-19912, that let a remote, unauthenticated attacker read arbitrary files from a server and execute code through unsafe deserialization in mwEmbedLoader.php. The note said the vulnerable endpoint is exposed on customer installations and shared multi-tenant CDN infrastructure.

    Show sources