Calcom
7 CVEs across 3 Calcom products. Browse Calcom vulnerabilities, severities, and proof-of-concept exploits.
Calcom products with known CVEs
Calcom CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-71389 | Critical | 10.0 | 2026-07-23 | Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Compone… |
CVE-2024-58355 | High | 8.9 | 2026-07-23 | Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/bookin… |
CVE-2024-58354 | Critical | 9.9 | 2026-07-23 | cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses… |
CVE-2024-58353 | High | 8.9 | 2026-07-23 | Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /bo… |
CVE-2026-63768 | Medium | 4.3 | 2026-07-20 | cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary… |
CVE-2026-9349 | Medium | 5.3 | 2026-05-24 | A vulnerability was determined in calcom cal.diy up to 4.9.4. Affected by this issue is the function getServerSideProps of the file apps/web/modules/bookings/v… |
CVE-2026-9304 | Medium | 5.0 | 2026-05-23 | A security flaw has been discovered in calcom cal.diy up to 4.9.4. The affected element is the function validateUrlForSSRF of the file apps/web/app/api/logo/ro… |
CVE-2026-9303 | Medium | 4.3 | 2026-05-23 | A vulnerability was identified in calcom cal.diy up to 4.9.4. Impacted is an unknown function. The manipulation leads to cross-site request forgery. It is poss… |
CVE-2026-23478 | Critical | 9.8 | 2026-01-13 | Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gai… |
CVE-2025-66489 | Critical | 9.8 | 2025-12-03 | Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a… |
CVE-2023-37919 | Medium | 6.5 | 2023-07-25 | Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When ac… |
CVE-2023-1647 | High | 8.8 | 2023-03-27 | Improper Access Control in GitHub repository calcom/cal.com prior to 2.7.
|