calcom vulnerabilities

CVEs per yearBy the year they were published

1. 20232
2. 20251
3. 202612

Newest CVEs

• CVE-2026-112043

  calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization

  calcom · cal.com

  Medium5.3
• CVE-2026-109143

  calcom cal.com/cal.diy Credentials delete credentials.delete privileges management

  calcom · cal.com

  Medium5.3
• CVE-2026-104054

  calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization

  calcom · cal.diy

  Medium5.3
• CVE-2025-71389

  Cal.com before 5.9.9 Remote Code Execution via RSC

  calcom · cal.diy

  Critical10.0
• CVE-2024-58355

  Cal.com through 4.7.15 Cross-Site Scripting via booking questions

  calcom · cal.diy

  Critical9.3
• CVE-2024-58354

  cal.com Repository Takeover via pull_request_target Workflow

  calcom · cal.diy

  High8.5
• CVE-2024-58353

  Cal.com through 4.7.15 Cross-Site Scripting via booking questions

  calcom · cal.diy

  Critical9.3
• CVE-2026-63768

  cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State

  calcom · cal.diy

  Medium5.3
• CVE-2026-9349

  calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure

  calcom · cal.diy

  Medium6.9
• CVE-2026-9304

  calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery

  calcom · cal.diy

  Low2.3