Calcom Cal.com vulnerabilities

• calcom cal.com, cal.diy +1 more calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization CVE-2026-112043 5.3 MediumOctober 19, 2026
• calcom cal.com, cal.diy +1 more calcom cal.com/cal.diy Credentials delete credentials.delete privileges management CVE-2026-109143 5.3 MediumOctober 13, 2026
• cal cal.com Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback CVE-2026-23478 10.0 CriticalJanuary 13, 2026
• cal cal.com Cal.com Authentication Bypass via bad TOTP + password checks CVE-2025-66489 9.9 CriticalDecember 3, 2025
• cal.com WordPress Cal.com plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability CVE-2025-31604 6.5 MediumMarch 31, 2025
• cal cal.com Cal.com not expiring old sessions after enabling 2FA CVE-2023-37919 6.5 MediumJuly 25, 2023
• cal cal.com, calcom calcom/cal.com +1 more Improper Access Control in calcom/cal.com CVE-2023-1647 8.8 HighMarch 27, 2023