As cited
Copy frozen at (site build).
vulnerabilities
Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code
CERT/CC disclosed two unpatched vulnerabilities in Kaltura's mwEmbed HTML5 video player library. The flaws, CVE-2026-19913 and CVE-2026-19912, result from unsafe deserialization in the mwEmbedLoader.php endpoint, allowing remote, unauthenticated attackers to read arbitrary files and execute code on affected servers.
Why it matters: Organizations running unpatched Kaltura video players face immediate risk of file disclosure and remote code execution (RCE) from external attackers; patch or isolate the mwEmbedLoader.php endpoint now.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code
CERT/CC disclosed two unpatched vulnerabilities in Kaltura's mwEmbed HTML5 video player library. The flaws, CVE-2026-19913 and CVE-2026-19912, result from unsafe deserialization in the mwEmbedLoader.php endpoint, allowing remote, unauthenticated attackers to read arbitrary files and execute code on affected servers.
Why it matters: Organizations running unpatched Kaltura video players face immediate risk of file disclosure and remote code execution (RCE) from external attackers; patch or isolate the mwEmbedLoader.php endpoint now.
- Source published
- First seen by Cybersecurity Tracker