CVE-2026-105106: Koha
- Severity
- 8.8 (HIGH)
- Patch status
- Unknown
- Published
- 2026-10-14T08:17:03.587
- Modified
- 2026-10-14T18:17:23.040
Why it matters
High-severity vulnerability requiring prioritized review.
Recommended admin actions
- Review and patch based on exposure, asset criticality, and business impact.
- Compare installed versions against the affected version range in the advisory.
Technical summary
Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.
View the official NVD record for CVE-2026-105106
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
824 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-107594 |
File Upload to Order PATCH
Reporter: CONTACT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-55572 |
e107 is a content management system (CMS) PATCH
Reporter: SECURITY-ADVISORIES
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-77524 |
KEDA is a Kubernetes-based Event Driven Autoscaling component. In PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-108390 |
Hestia Control Panel is a lightweight and powerful control panel for the modern web PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-110392 |
an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-93388 |
Printcart Store – Web to Print Product Designer for WooCommerce
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-110002 |
Snazzy Social Media Feed
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97657 |
Abandoned Cart Pro for WooCommerce
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97668 |
Abandoned Cart Pro for WooCommerce
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-104800 |
AGE-GATE
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-87855 |
JTL-Connector for WooCommerce
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-104748 |
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-107424 |
M A Vinoth Kumar Frontend Dashboard frontend-dashboard
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-108291 |
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-16740 |
TR7 ASP: from 1.0.40.236 PATCH
Reporter: ILETISIM
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-16741 |
TR7 ASP: from 1.0.40.236 PATCH
Reporter: ILETISIM
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-108065 |
Channel Software WebAlliance eCommerce [VERSION — missing]
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-59774 |
Gitea
Reporter: 88EE5874-CF24-4952-AEA0-31AFFEDB7FF2
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-76519 EXPLOITED |
Cisco Secure Email
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-55573 |
e107 is a content management system (CMS) PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-55680 |
WeGIA is a web manager for charitable institutions PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-55683 |
WeGIA is a web manager for charitable institutions PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-55684 |
WeGIA is a web manager for charitable institutions PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-89310 |
JTL-WMS
Reporter: A6D3DC9E-0591-4A13-BCE7-0F5B31FF6158
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2020-37282 |
office-converter
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110612 |
vlife
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110631 |
Komodo
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110634 |
git-diff PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110635 |
webp-converter PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110636 |
pypdftk
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110638 |
doc-recog
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110639 |
@mborne/extract PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110640 |
Whisper-node
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110643 |
transcribe2texts
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110644 |
nodejs-whisper
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110645 |
Video-stitch PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110649 |
Stills PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110650 |
The thumbnail Python package
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101950 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101956 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101967 |
Junos OS Evolved
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101980 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101986 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101990 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102031 |
Junos OS Evolved
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102175 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102178 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102182 |
the kmd component of Juniper Networks Junos OS on MX Series PATCH
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109439 |
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-33792 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-33796 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101954 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101982 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101983 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-103415 |
ECLIPSE
Reporter: EMO
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-77371 |
Product identification pending PATCH
Reporter: SECURITY-ADVISORIES
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-92152 |
Product identification pending PATCH
Reporter: SECURITY-ADVISORIES
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110536 |
DIR-868L
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110862 |
Better Auth from 1.4.0-beta.18 PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110447 |
Collabora Online Built-in CODE Server PATCH
Reporter: CVE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-14851 |
Copart’s online billing service
Reporter: CVE-COORDINATION
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2020-37281 |
Gravitee API Management
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110616 |
NullHub
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110628 |
Kan 0.5.5
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110632 |
MyReport Updater
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110646 |
Beganovich snappdf from 1.1.0 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-15176 |
NGINX Plus
Reporter: F5SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-93479 |
NGINX Plus
Reporter: F5SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-97205 |
NGINX Plus
Reporter: F5SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-101955 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-101997 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102037 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102062 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102068 |
Junos OS Evolved
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102070 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102084 |
the VPN daemon of Juniper Networks Junos OS on SRX Series PATCH
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-33789 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102748 |
Dgraph is an open source distributed GraphQL database PATCH
Reporter: SECURITY-ADVISORIES
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110770 |
Databasus 3.7.0
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110858 |
GitPython from 3.1.30 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-92097 |
Click to Chat – HoliThemes
Reporter: SECURITY
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-102893 |
Zulip is an open-source team collaboration tool. In Zulip Server PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-102476 |
Product identification pending
Reporter: EMO
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-85714 |
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-108335 |
HITACHIVANTARA
Reporter: SECURITY.VULNERABILITIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-108336 |
HITACHIVANTARA
Reporter: SECURITY.VULNERABILITIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-110864 |
Better Auth from 1.5.0-beta.12 PATCH
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-86002 |
Dokku is a docker-powered platform as a service. In Dokku PATCH
Reporter: SECURITY-ADVISORIES
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-91881 |
Dell Terraform Provider for Redfish PATCH
Reporter: SECURITY_ALERT
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-110867 |
Renovate PATCH
Reporter: DISCLOSURE
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-105429 |
the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird PATCH
Reporter: 33C584B5-0579-4C06-B2A0-8D8329FCAB9C
|
8.9
HIGH
|
VIEW RECORD |
| CVE-2026-107126 |
The WP Booking System WordPress plugin PATCH
Reporter: CONTACT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-86799 |
The Forms WordPress plugin PATCH
Reporter: CONTACT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-105106 |
Koha PATCH
Reporter: 309F9EA4-E3E9-4C6C-B79D-E8EB01244F2C
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-104795 |
REDHAT
Reporter: SECALERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-106599 |
Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-71184 |
Gitea
Reporter: 88EE5874-CF24-4952-AEA0-31AFFEDB7FF2
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-87093 |
MOVEit Transfer PATCH
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-89067 |
MOVEit Transfer PATCH
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-101966 |
the jti-dialoutd of Juniper Networks Junos OS Evolved
Reporter: SIRT
|
8.8
HIGH
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.