https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43837 Bug ID: 43837 Summary: [INC-2026-0183] CVE Coordination in Koha Initiative type: --- Sponsorship --- status: Product: Koha Version: 26.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: bugs.koha-community.org Assignee: koha-bugs@lists.koha-community.org Reporter: cve-coordination@incibe.es QA Contact: testopia@bugs.koha-community.org Target Milestone: --- Created attachment 208303 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208303&action=edit draft vulnerability 1 Dear Koha team, We are writing to you from INCIBE, Spain's National Cybersecurity Institute, regarding 3 vulnerabilities reported by an external researcher in one of your products. We participate in the CVE Program as CNA Root (https://www.cve.org/ProgramOrganization/Structure), which allows us to assign and publish CVE codes. Please note that this report is not about an incident, i.e. no one is exploiting the vulnerability. At INCIBE, we are responsible for managing the documentation and publication of the CVE identifier, in coordination with the affected parties. As established in our disclosure policy, we have set a default period of 60 days for you to take some kind of action to resolve these vulnerabilities, so we will begin working on its publication once this period has ended. If you wish to include a solution or additional information for the problems reported in this email, please respond before the expiry date. Please find attached the drafts of the vulnerabilities. Thank you very much and best regards, -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.