KC
Vendor security profile
Koha Community
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs15
Critical0
CISA KEV0
Public exploit3
Patch rate%7
Avg. CVSS7.6
12-month vulnerability rate
0
0
0
0
1
0
0
1
0
11
0
2
CVE KEV
CVE severity distribution
15toplam CVE
High11 (73%)
Medium4 (27%)
Patch and exploitation view
%7
Verified patch
%0
CISA KEV
%20
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
14Unknown
Latest vulnerabilities
7.6
CVE-2026-105107
Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters
KC
Patch status unknownEPSS %0
8.8
CVE-2026-105106
Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task
KC
Patch status unknownEPSS %2
5.1
CVE-2026-41921
Koha Stored XSS via Purchase Suggestion Handler
KC
Patch status unknownEPSS %0
4.3
CVE-2026-72610
Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation
KC
Patch status unknownEPSS %0
7.1
CVE-2026-72609
Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl
KC
Patch status unknownEPSS %0
6.5
CVE-2026-72608
Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name
KC
Patch status unknownEPSS %0
7.1
CVE-2026-72607
Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age
KC
Patch status unknownEPSS %0
8.8
CVE-2026-71288
Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl
KC
Patch status unknownEPSS %1
8.8
CVE-2026-70373
Koha - SQL Injection in reports/issues_stats.pl
KC
Patch status unknownEPSS %1
8.8
CVE-2026-70372
Koha - SQL Injection in reports/bor_issues_top.pl
KC
Patch status unknownEPSS %1