calcom

Products

Exploited and recent CVEs

• CVE-2026-112043 Medium 6.3 calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization 0.4%
• CVE-2026-112043 Medium 6.3 calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization 0.4%
• CVE-2026-109143 Medium 5.4 calcom cal.com/cal.diy Credentials delete credentials.delete privileges management 0.2%
• CVE-2026-109143 Medium 5.4 calcom cal.com/cal.diy Credentials delete credentials.delete privileges management 0.2%
• CVE-2026-104054 Medium 6.3 calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization 0.2%
• CVE-2025-71389 Critical 10.0 Cal.com before 5.9.9 Remote Code Execution via RSC 1.4%
• CVE-2024-58355 High 8.9 Cal.com through 4.7.15 Cross-Site Scripting via booking questions 0.4%
• CVE-2024-58354 Critical 9.9 cal.com Repository Takeover via pull_request_target Workflow 0.5%
• CVE-2024-58353 High 8.9 Cal.com through 4.7.15 Cross-Site Scripting via booking questions 0.4%
• CVE-2026-63768 Medium 4.3 cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State 0.3%
• CVE-2026-9349 Medium 5.3 calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure 0.4%
• CVE-2026-9304 Medium 5.0 calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery 0.2%
• CVE-2026-9303 Medium 4.3 calcom cal.diy cross-site request forgery 0.2%
• CVE-2026-23478 Critical 10.0 Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback 0.5%
• CVE-2025-66489 Critical 9.9 Cal.com Authentication Bypass via bad TOTP + password checks 1.0%
• CVE-2023-37919 Medium 6.5 Cal.com not expiring old sessions after enabling 2FA 0.3%
• CVE-2023-1647 High 8.8 Improper Access Control in calcom/cal.com 0.8%