Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code

CERT/CC disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library, tracked as CVE-2026-19913 and CVE-2026-19912, that allow a remote, unauthenticated attacker to read arbitrary files and execute code. Both flaws stem from unsafe deserialization in the mwEmbedLoader.php endpoint of the mwEmbed player.