koha koha

Name: koha koha
Brand: koha

productUS

cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

4critical8high6medium0low

updated 2026-10-28

vulnerabilities (24)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2015-4632US	high7.5	51.8% (99th)	Exploit	3.16.12	2018-10-18	4 versions
CVE-2011-4715US	medium5.0	8.62% (95th)	Exploit	no fix	2011-12-08	8 versions
CVE-2015-4633US	critical9.8	6.07% (93rd)	Exploit	3.16.12	2018-10-18	4 versions
CVE-2015-4631US	medium5.4	3.71% (90th)	Exploit	3.14.16	2018-10-18	4 versions
CVE-2015-4630US	high8.0	2.97% (87th)	Exploit	3.20.1	2018-10-18	4 versions
CVE-2026-31844US	—	0.38% (32nd)	Exploit	24.11.12	2026-03-11	3 versions
CVE-2024-28739US	high7.2	18.9% (97th)	—	no fix	2024-08-06	≤ 23.05.00
CVE-2014-1923US	high7.5	3.46% (89th)	—	3.10.13	2020-01-24	4 versions
CVE-2014-1922US	high7.5	2.31% (83rd)	—	3.10.13	2020-01-24	4 versions
CVE-2014-1924US	critical9.8	2.04% (81st)	—	3.14.03	2020-01-24	4 versions
CVE-2014-1925US	critical9.8	1.99% (81st)	—	3.10.13	2020-01-24	4 versions
CVE-2014-9446US	medium4.3	1.22% (69th)	—	no fix	2015-01-02	3 versions
CVE-2024-24337US	high8.0	0.81% (57th)	—	no fix	2024-02-12	≤ 23.05.05
CVE-2024-28740US	critical9.6	0.71% (53rd)	—	no fix	2024-08-06	≤ 23.05.00
CVE-2018-1000670US	medium6.1	0.65% (51st)	—	no fix	2018-09-06	2 versions
CVE-2015-4639US	high8.8	0.62% (49th)	—	no fix	2017-07-21	29 versions
CVE-2023-5025US	medium5.4	0.61% (49th)	—	no fix	2023-09-17	≤ 23.05.03
CVE-2018-1000669US	high8.8	0.48% (41st)	—	no fix	2018-09-06	2 versions
CVE-2026-26377US	medium5.4	0.39% (33rd)	—	no fix	2026-03-05	≤ 25.11.00
CVE-2026-50765US	—	0.31% (24th)	—	no fix	2026-06-26	≤ 25.11.00
CVE-2026-26378US	—	0.30% (23rd)	—	no fix	2026-06-03	≤ 25.11.00
CVE-2026-50767US	—	0.28% (20th)	—	no fix	2026-06-26	≤ 25.11.00
CVE-2026-50766US	—	0.28% (20th)	—	no fix	2026-06-26	≤ 25.11.00
CVE-2026-26379US	—	0.24% (15th)	—	no fix	2026-06-03	≤ 25.11.00

weaknesses (7)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')11 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')4 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')4 CVEs
CWE-352Cross-Site Request Forgery (CSRF)3 CVEs
CWE-1236Improper Neutralization of Formula Elements in a CSV File1 CVEs
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')1 CVEs
CWE-918Server-Side Request Forgery (SSRF)1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE24 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan