Koha Community has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 7.6 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.6
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-105106High· 8.8Koha is vulnerable to OS command injection in the Task Scheduler deletion path61CVE-2026-105107High· 7.6Koha is vulnerable to SQL injection in the Most-circulated items report42CVE-2026-41921Medium· 5.4Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input throug…30
Koha Community vulnerabilities
CVEs affecting Koha Community, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-105107High· 7.6Koha is vulnerable to SQL injection in the Most-circulated items report
Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Crit…
CVE-2026-105106High· 8.8PoCKoha is vulnerable to OS command injection in the Task Scheduler deletion path
Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Sch…
CVE-2026-41921Medium· 5.4Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input throug…
Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input throug…