calcom cal.com

• CVE-2026-112043 Medium 6.3 calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization 0.4%
• CVE-2026-109143 Medium 5.4 calcom cal.com/cal.diy Credentials delete credentials.delete privileges management 0.2%
• CVE-2026-23478 Critical 10.0 Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback 0.5%
• CVE-2025-66489 Critical 9.9 Cal.com Authentication Bypass via bad TOTP + password checks 1.0%
• CVE-2023-37919 Medium 6.5 Cal.com not expiring old sessions after enabling 2FA 0.3%