koha has 2 CVEs on record. 1 was published in the last 90 days. The median CVSS is 8.8 (high).
CVEs per month
Last 12 months, by publish date
1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —
- Last 90 days
- 1 prev 0
2
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-19780High· 8.8Koha Eval Code Injection Remote Code Execution Vulnerability74CVE-2026-31844High· 8.8An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functiona…60
koha vulnerabilities
CVEs affecting koha, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-19780High· 8.80dayKoha Eval Code Injection Remote Code Execution Vulnerability
Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific…
▾ AbyssalKoha · KohaEPSS 0.96%via NVD
CVE-2026-31844High· 8.8PoCAn authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functiona…
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functiona…
▾ Midnightkoha · kohaEPSS 0.37%via NVD