CVE-2026-19780

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 8081 by default. The issue results from the lack of proper validation of a user-supplied string before passing it to the eval function. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-29165.

• CWE-95

• https://www.zerodayinitiative.com/advisories/ZDI-26-616/

Published

Sep 15, 2026

Last Modified

Sep 15, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19770A vulnerability was identified in feedmob fm-mcp-servers 0.0…5.3
• CVE-2026-19771A vulnerability was identified in Baicells EG3661M BaiCE_BQ6…7.2
• CVE-2026-19773libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds…9.8
• CVE-2026-19774BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution…7.1
• CVE-2026-19778The WPMR Google Feed Manager for WooCommerce – Sell on Googl…6.5
• CVE-2026-1978A vulnerability was detected in kalyan02 NanoCMS up to 0.4. …7.5
• CVE-2026-19781Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overf…7.8
• CVE-2026-19782The WPS Bidouille WordPress plugin before 1.33.5 does not ha…5.4
• CVE-2026-19783IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a …7.8
• CVE-2026-19784A flaw has been found in francoisjacquet RosarioSIS up to 12…4.3
• CVE-2026-19785A vulnerability has been found in francoisjacquet RosarioSIS…6.3
• CVE-2026-19786A vulnerability was found in francoisjacquet RosarioSIS up t…5.3