Threats Tagged 'cve-2026-19913'

Red Hat OpenShift AI 3.5.1 has been released with important security updates addressing multiple vulnerabilities identified by various CVEs including CVE-2026-19913. The advisory highlights the availability of updated images and provides guidance for upgrading clusters to apply the errata. No specific fixes or technical details about the vulnerabilities are provided in the advisory content. The severity of the issues is rated as high. There are no known exploits in the wild at this time.

The Kaltura HTML5 Player Library (mwEmbed / html5lib) versions v2.45, v2.103, and earlier v2.x releases contain two vulnerabilities involving insecure deserialization. These flaws allow remote, unauthenticated attackers to read arbitrary local files and execute arbitrary code as the web-server user via the vulnerable mwEmbedLoader.php endpoint. The vulnerabilities stem from unsafe deserialization of user-controlled input and insufficient sanitization of a path parameter, enabling directory traversal and remote code execution. These issues affect legacy Player V2 versions but not the currently supported Player V7. Until patches are applied, restricting or disabling access to the vulnerable endpoint is advised.