Koha

koha-community.org ↗
D
RISKY
16
Total CVEs
2
Crit / High
0
Medium
48%
Unpatched
0%
Patched
8.8
Avg CVSS
0
CISA KEV
// Data sourced from NVD · CISA KEV · RHSA · GHSA · Debian · OSV · EPSS · Exploit-DB How we collect data →
// INTEL UPGRADE
Full Company Dossier — Coming Soon
Executive profiles, financial exposure, M&A risk, breach history & supply-chain threat mapping — all in one place.
OSINT FINANCIALS EXEC PROFILES BREACH DB
▸ CVE Trend by Year
▸ Patch Coverage
Patched
0%
Unpatched
48%
Under Review
22%
Pending
30%
✓ 0 patched ✗ 11 unpatched ~ 5 under review ⏳ 7 pending score
▸ Intelligence by Audience
PoC Available
11 / 20 shown
CISA KEV (Exploited)
0
Shodan Dorks
ssl:"koha" port:443
org:"Koha" http.status:200
Top EPSS (Exploitation Probability)
CVE-2025-22954 25.55% exploitation probability
CVE-2024-28740 5.64% exploitation probability
CVE-2024-36057 1.80% exploitation probability
CVE-2026-105106 1.61% exploitation probability
CVE-2026-19780 0.96% exploitation probability
Quick Facts for Reporting
Total CVEs tracked
16
Critical severity
1
Actively exploited (CISA)
0
Unpatched ratio
48%
Avg CVSS score
8.8
Security grade
D (RISKY)
NVD Data Attribution
Source: NIST National Vulnerability Database (NVD) + GitHub Advisory Database.
Data aggregated by Valters IT Hub · valtersit.com
Last updated: 2026-08-03
Security Risk Score (for investors)
LOW
Vuln Volume
AVG
Patch Responsiveness
LOW
CISA Exposure
⚠ Not financial advice. Past security incidents do not guarantee future stock performance.
▸ Security News Google News
US weapons vulnerable to cyber attacks - KOHA.net
KOHA.net 2024-09-30
▸ Recent CVEs showing 20 of 23
CVE IDSeverityPatchEPSSDate
CVE-2026-105107 7.6 HIGH UNKNOWN / UNPATCHED 0.28% 2026-10-14
CVE-2026-105106 8.8 HIGH UNKNOWN / UNPATCHED 1.61% 2026-10-14
CVE-2026-19780 8.8 HIGH UNKNOWN / UNPATCHED 0.96% 2026-09-15
CVE-2026-72608 6.5 MEDIUM UNKNOWN / UNPATCHED 0.22% 2026-08-11
CVE-2026-72607 PoC 7.1 HIGH UNKNOWN / UNPATCHED 0.27% 2026-08-11
CVE-2026-72609 7.1 HIGH UNKNOWN / UNPATCHED 0.22% 2026-08-11
CVE-2026-72610 PoC 4.3 MEDIUM UNKNOWN / UNPATCHED 0.20% 2026-08-11
CVE-2026-50765 PoC ? N/A UNKNOWN / UNPATCHED 0.31% 2026-06-26
CVE-2026-50767 PoC 5.7 MEDIUM UNKNOWN / UNPATCHED 0.28% 2026-06-26
CVE-2026-50766 PoC 6.3 MEDIUM UNKNOWN / UNPATCHED 0.28% 2026-06-26
CVE-2026-26379 PoC 8.8 HIGH UNKNOWN / UNPATCHED 0.37% 2026-06-03
CVE-2026-26378 PoC ? N/A UNKNOWN / UNPATCHED 0.30% 2026-06-03
CVE-2024-36058 ? N/A PATCH UNDER REVIEW 0.48% 2026-04-07
CVE-2024-36057 ? N/A PATCH UNDER REVIEW 1.80% 2026-04-07
CVE-2026-31844 8.8 HIGH PATCH UNDER REVIEW 0.59% 2026-03-11
CVE-2026-26377 PoC 5.4 MEDIUM UNKNOWN / UNPATCHED 0.37% 2026-03-05
CVE-2025-52360 PoC ? N/A UNKNOWN / UNPATCHED 0.34% 2025-07-25
CVE-2025-30076 PoC 7.7 HIGH PATCH UNDER REVIEW 0.06% 2025-03-16
CVE-2025-22954 10.0 CRITICAL PATCH UNDER REVIEW 25.55% 2025-03-12
CVE-2024-28740 PoC ? N/A UNKNOWN / UNPATCHED 5.64% 2024-08-06
View all 23 CVEs for Koha →
▸Intel
Founded1999
Trust ScoreD — RISKY
Max CVSS10.0
Last Updated2026-08-03
▸Top Weaknesses
CWE-79
Cross-Site Scripting (XSS)
9 occurrences in Koha CVEs (56% of total)
CWE-79 ⓘ
9
CWE-89
SQL Injection
3 occurrences in Koha CVEs (19% of total)
CWE-89 ⓘ
3
CWE-78
Unknown Weakness Type
2 occurrences in Koha CVEs (13% of total)
CWE-78 ⓘ
2
CWE-77
Unknown Weakness Type
1 occurrence in Koha CVEs (6% of total)
CWE-77 ⓘ
1
CWE-94
Code Injection
1 occurrence in Koha CVEs (6% of total)
CWE-94 ⓘ
1
▸Company Profile

Koha is an open-source integrated library system (ILS) used by libraries worldwide for cataloging, circulation, and patron management. It is one of the most widely deployed open-source library systems, with a significant community-driven development model. Its cybersecurity relevance stems from its role in managing sensitive patron data and its exposure to web-based attacks through its OPAC and staff interfaces.

▸Response Metrics
Est. MTTR ⓘ ~500 days (Critical)
Mean Time To Remediate. Estimates days from CVE disclosure to patch.
Industry avg: ~60d (good) · 100-300d (poor) · 300d+ (critical)
CVE Trend ⓘ ↗ +200% worse
CVE count 2026 vs 2025:  3 → 9 CVEs
Patch Speed ⓘ Poor (>65% open)
48% of CVEs still unpatched.  Excellent: <20% · Good: 20-40% · Avg: 40-65% · Poor: >65%
▸ Financial Risk Estimate
Est. GDPR Low
€610K
Est. GDPR High
€6.1M

Based on 1 critical CVEs, 0 CISA KEV, 100% unpatched. Model: GDPR Art.83 · not legal advice.

▸Actions
⚖ Compare with another vendor
▸Embed Badge
Koha D valtersit.com