K
Vendor security profile
koha
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs21
Critical0
CISA KEV0
Public exploit7
Patch rate%5
Avg. CVSS7.2
12-month vulnerability rate
0
0
0
0
1
0
0
6
0
11
1
2
CVE KEV
CVE severity distribution
21toplam CVE
High12 (57%)
Medium9 (43%)
Patch and exploitation view
%5
Verified patch
%0
CISA KEV
%33
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
20Unknown
Latest vulnerabilities
7.6
CVE-2026-105107
Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters
KC
Patch status unknown
8.8
CVE-2026-105106
Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task
KC
Patch status unknown
8.8
CVE-2026-19780
Koha Eval Code Injection Remote Code Execution Vulnerability
K
Patch status unknownEPSS %1
5.1
CVE-2026-41921
Koha Stored XSS via Purchase Suggestion Handler
KC
Patch status unknownEPSS %0
4.3
CVE-2026-72610
Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation
KC
Patch status unknownEPSS %0
7.1
CVE-2026-72609
Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl
KC
Patch status unknownEPSS %0
6.5
CVE-2026-72608
Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name
KC
Patch status unknownEPSS %0
7.1
CVE-2026-72607
Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age
KC
Patch status unknownEPSS %0
8.8
CVE-2026-71288
Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl
KC
Patch status unknownEPSS %1
8.8
CVE-2026-70373
Koha - SQL Injection in reports/issues_stats.pl
KC
Patch status unknownEPSS %1