Read the docs

Cal.com

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Cal.com records in CISA KEV

No Cal.com vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-13873 CVE-2026-16624 · GHSA-72qw-2qpq-fg7j

Authorization bypass in Cal.com Cal.diy

Priority HIGH 76

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer…

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00355 Published 2026-07-22 Fixed in 6.2.0 CWE-639
TI-2026-41662 CVE-2026-57858 · GHSA-5m2w-xrqj-9hhh

Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID

Priority HIGH 75

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a…

CVSS 4.0CRITICAL 9.3 Network Low privileges User interaction EPSS 0.0037 Published 2026-08-12 No fix listed CWE-79
TI-2025-22767 CVE-2025-31604 · GHSA-crgj-f248-f5xj

WordPress Cal.com plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cal.com Cal.com cal-com allows Stored XSS.This issue affects Cal.com: from n/a through <= 1.0.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00214 Published 2025-03-31 No fix listed CWE-80
Open these records in search →