Koha vulnerabilities
CVEs whose affected-version data names the Koha package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-19780High· 8.80dayKoha Eval Code Injection Remote Code Execution Vulnerability
Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific…
▾ AbyssalKoha · KohaEPSS 0.96%via NVD
CVE-2026-31844High· 8.8PoCAn authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functiona…
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functiona…
▾ Midnightkoha · kohaEPSS 0.37%via NVD