TI-2024-38439 CVE-2024-58355 · GHSA-884j-pvgh-233q
Cal.com through 4.7.15 Cross-Site Scripting via booking questions
Priority HIGH 75
Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability.
calcom
Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
calcom records in CISA KEVNo calcom vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
15 records
TI-2024-38437 CVE-2024-58353 · GHSA-mxrg-5554-pp4x
Cal.com through 4.7.15 Cross-Site Scripting via booking questions
Priority HIGH 73
Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booking/<id>).
TI-2024-38438 CVE-2024-58354 · GHSA-hv2p-r28v-79q5
cal.com Repository Takeover via pull_request_target Workflow
Priority HIGH 72
cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows.
TI-2026-08199 CVE-2026-9349 · GHSA-23fj-h8hh-93x3
calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure
Priority HIGH 70
A vulnerability was determined in calcom cal.diy up to 4.9.4.
Priority MEDIUM 62
Cal.com is open-source scheduling software.
TI-2026-76231 CVE-2026-112043 · GHSA-6wcv-37vq-r5jx
Authorization bypass in cal.com and cal.diy webhook handler
Priority MEDIUM 57
A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0.
TI-2026-71619 CVE-2026-109143 · GHSA-72px-hx9f-mc45
Improper privilege management in Cal.com credential deletion
Priority MEDIUM 57
A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0.
TI-2026-66048 CVE-2026-104054 · GHSA-48q5-8whv-r6xj
calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization
Priority MEDIUM 57
A security flaw has been discovered in calcom cal.diy up to 6.2.0.
TI-2026-08169 CVE-2026-9303 · GHSA-m2vm-mcmh-jrc7
calcom cal.diy cross-site request forgery
Priority MEDIUM 57
A vulnerability was identified in calcom cal.diy up to 4.9.4.
TI-2025-43505 CVE-2025-71389 · GHSA-8449-9vw6-7mp5
Cal.com before 5.9.9 Remote Code Execution via RSC
Priority MEDIUM 52
Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled i…
TI-2026-18911 CVE-2026-23478
Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback
Priority MEDIUM 49
Cal.com is open-source scheduling software.
TI-2026-08170 CVE-2026-9304 · GHSA-6c7x-v3mr-g29x
calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery
Priority MEDIUM 45
A security flaw has been discovered in calcom cal.diy up to 4.9.4.
Priority MEDIUM 44
Cal.com is open-source scheduling software.
TI-2023-01550 CVE-2023-1647 · GHSA-976q-qhh2-p88c
Improper Access Control in calcom/cal.com
Priority MEDIUM 42
Improper Access Control in GitHub repository calcom/cal.com prior to 2.7.
TI-2026-45355 CVE-2026-63768 · GHSA-5wvx-w47w-mg4x
cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State
Priority LOW 24
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters.