Product by Calcom

    Cal.diy

    11 known vulnerabilities in Cal.diy (Calcom), 0 of them actively exploited (CISA KEV).

    Key figures

    11

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    4

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Cal.diy (Calcom)
    CriticalCVE-2025-71389

    Cal.com before 5.9.9 Remote Code Execution via RSC

    		10.0
    CriticalCVE-2024-58354

    cal.com Repository Takeover via pull_request_target Workflow

    		9.9
    CriticalCVE-2024-58355

    Cal.com through 4.7.15 Cross-Site Scripting via booking questions

    		8.9
    CriticalCVE-2024-58353

    Cal.com through 4.7.15 Cross-Site Scripting via booking questions

    		8.9
    MediumCVE-2026-112043

    calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization

    also in 1 other product

    		6.3
    MediumCVE-2026-104054

    calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization

    		6.3
    MediumCVE-2026-9349

    Calcom Cal.diy: Exposure of Sensitive Information to an Unauthorized Actor

    		5.3
    MediumCVE-2026-109143

    calcom cal.com/cal.diy Credentials delete credentials.delete privileges management

    also in 1 other product

    		5.4
    MediumCVE-2026-63768

    cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State

    		4.3
    MediumCVE-2026-9303

    calcom cal.diy cross-site request forgery

    		4.3
    MediumCVE-2026-9304

    calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery

    		5.0

    All products by Calcom