What’s Vulnerable › Products

calcom cal.diy vulnerabilities

11 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your calcom cal.diy version is affected

Latest calcom cal.diy vulnerabilities

• CVE-2026-112043 — calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization (CVSS 6.3)
• CVE-2026-109143 — calcom cal.com/cal.diy Credentials delete credentials.delete privileges management (CVSS 5.4)
• CVE-2026-104054 — calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization (CVSS 6.3)
• CVE-2025-71389 — Cal.com before 5.9.9 Remote Code Execution via RSC (CVSS 10.0)
• CVE-2024-58355 — Cal.com through 4.7.15 Cross-Site Scripting via booking questions (CVSS 8.9)
• CVE-2024-58354 — cal.com Repository Takeover via pull_request_target Workflow (CVSS 9.9)
• CVE-2024-58353 — Cal.com through 4.7.15 Cross-Site Scripting via booking questions (CVSS 8.9)
• CVE-2026-63768 — cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State (CVSS 4.3)
• CVE-2026-9349 — calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure (CVSS 5.3)
• CVE-2026-9304 — calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery (CVSS 5.0)
• CVE-2026-9303 — calcom cal.diy cross-site request forgery (CVSS 4.3)