Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: Cal.com Clear all filters
TI-2026-41662 CVE-2026-57858 · GHSA-5m2w-xrqj-9hhh

Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID

Priority HIGH 75

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a…

CVSS 4.0CRITICAL 9.3 Network Low privileges User interaction EPSS 0.0037 Published 2026-08-12 No fix listed CWE-79
TI-2026-13873 CVE-2026-16624 · GHSA-72qw-2qpq-fg7j

Authorization bypass in Cal.com Cal.diy

Priority HIGH 76

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer…

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00355 Published 2026-07-22 Fixed in 6.2.0 CWE-639
TI-2025-22767 CVE-2025-31604 · GHSA-crgj-f248-f5xj

WordPress Cal.com plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cal.com Cal.com cal-com allows Stored XSS.This issue affects Cal.com: from n/a through <= 1.0.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00214 Published 2025-03-31 No fix listed CWE-80