Koha Community vulnerabilities

Newest CVEs

• CVE-2026-105107

  Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters

  Koha Community · Koha

  High7.2
• CVE-2026-105106

  Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task

  Koha Community · Koha

  High8.8
• CVE-2026-41921

  Koha Stored XSS via Purchase Suggestion Handler

  Koha Community · Koha

  Medium5.1
• CVE-2026-72610

  Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation

  Koha Community · Koha

  Medium4.3
• CVE-2026-72609

  Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl

  Koha Community · Koha

  High7.1
• CVE-2026-72608

  Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name

  Koha Community · Koha

  Medium6.5
• CVE-2026-72607

  Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age

  Koha Community · Koha

  High7.1
• CVE-2026-71288

  Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl

  Koha Community · Koha

  High8.8
• CVE-2026-70373

  Koha - SQL Injection in reports/issues_stats.pl

  Koha Community · Koha

  High8.8
• CVE-2026-70372

  Koha - SQL Injection in reports/bor_issues_top.pl

  Koha Community · Koha

  High8.8