Skip to content
Calcom vulnerabilities
Newest
-
calcom cal.com, cal.diy +1 more
calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization
CVE-2026-112043
5.3 Medium
-
calcom cal.com, cal.diy +1 more
calcom cal.com/cal.diy Credentials delete credentials.delete privileges management
CVE-2026-109143
5.3 Medium
-
calcom cal.diy
calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization
CVE-2026-104054
5.3 Medium
-
calcom cal.diy
Cal.com before 5.9.9 Remote Code Execution via RSC
CVE-2025-71389
Public exploit
10.0 Critical
-
calcom cal.diy
cal.com Repository Takeover via pull_request_target Workflow
CVE-2024-58354
8.5 High
-
calcom cal.diy
Cal.com through 4.7.15 Cross-Site Scripting via booking questions
CVE-2024-58355
9.3 Critical
-
calcom cal.diy
Cal.com through 4.7.15 Cross-Site Scripting via booking questions
CVE-2024-58353
9.3 Critical
-
cal.com cal.diy
CVE-2026-16624
CVE-2026-16624
9.6 Critical
-
calcom cal.diy
cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State
CVE-2026-63768
5.3 Medium
-
calcom cal.diy
calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure
CVE-2026-9349
6.9 Medium
-
calcom cal.diy
calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery
CVE-2026-9304
2.3 Low
-
calcom cal.diy
calcom cal.diy cross-site request forgery
CVE-2026-9303
5.3 Medium
-
cal cal.com
Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback
CVE-2026-23478
10.0 Critical
-
cal cal.com
Cal.com Authentication Bypass via bad TOTP + password checks
CVE-2025-66489
9.9 Critical
-
cal.com
WordPress Cal.com plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability
CVE-2025-31604
6.5 Medium
-
cal cal.com
Cal.com not expiring old sessions after enabling 2FA
CVE-2023-37919
6.5 Medium
-
cal cal.com, calcom calcom/cal.com +1 more
Improper Access Control in calcom/cal.com
CVE-2023-1647
8.8 High