Calcom Cal.diy vulnerabilities

• calcom cal.com, cal.diy +1 more calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization CVE-2026-112043 5.3 MediumOctober 19, 2026
• calcom cal.com, cal.diy +1 more calcom cal.com/cal.diy Credentials delete credentials.delete privileges management CVE-2026-109143 5.3 MediumOctober 13, 2026
• calcom cal.diy calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization CVE-2026-104054 5.3 MediumOctober 2, 2026
• calcom cal.diy Cal.com before 5.9.9 Remote Code Execution via RSC CVE-2025-71389 Public exploit 10.0 CriticalJuly 23, 2026
• calcom cal.diy cal.com Repository Takeover via pull_request_target Workflow CVE-2024-58354 8.5 HighJuly 23, 2026
• calcom cal.diy Cal.com through 4.7.15 Cross-Site Scripting via booking questions CVE-2024-58355 9.3 CriticalJuly 23, 2026
• calcom cal.diy Cal.com through 4.7.15 Cross-Site Scripting via booking questions CVE-2024-58353 9.3 CriticalJuly 23, 2026
• cal.com cal.diy CVE-2026-16624 CVE-2026-16624 9.6 CriticalJuly 22, 2026
• calcom cal.diy cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State CVE-2026-63768 5.3 MediumJuly 20, 2026
• calcom cal.diy calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure CVE-2026-9349 6.9 MediumMay 24, 2026
• calcom cal.diy calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery CVE-2026-9304 2.3 LowMay 23, 2026
• calcom cal.diy calcom cal.diy cross-site request forgery CVE-2026-9303 5.3 MediumMay 23, 2026