Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

CVE-2026-57858

Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close the inline script string literal with a crafted payload that executes in the browser of every visitor to the affected public booking page, enabling session cookie theft, forged authenticated requests, and wormable propagation by chaining with CSRF-able endpoints to persist payloads on additional events.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Cal Cal.com
Products
Cal.com Cal.com Self-hosted (cal.diy)
CVE-2025-71389

Cal.com before 5.9.9 Remote Code Execution via RSC

Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency.

CVSS 4.0 · 10 Critical EPSS 1.4% KEV · Not listed
Vendors
Cal Calcom
Products
Cal.com Cal.diy
CVE-2024-58355

Cal.com through 4.7.15 Cross-Site Scripting via booking questions

Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user input. An attacker who can create an event type with a malicious booking-question label can inject arbitrary HTML/JavaScript that executes when a victim opens the crafted booking URL. The issue is fixed in v4.7.16.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Cal Calcom
Products
Cal.com Cal.diy
CVE-2024-58353

Cal.com through 4.7.15 Cross-Site Scripting via booking questions

Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booking/<id>). Booking question (form field) labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an attacker who can create an event type with a malicious booking question label can inject arbitrary HTML/JavaScript that executes when a victim visits the booking view URL. Self-hosted instances with open registration are particularly at risk. The issue is fixed in version 4.7.16.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Cal Calcom
Products
Cal.com Cal.diy
CVE-2026-23478

Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback

Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Cal
Products
Cal.com
CVE-2025-66489

Cal.com Authentication Bypass via bad TOTP + password checks

Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in the authentication flow. This vulnerability is fixed in 5.9.8.

CVSS 4.0 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Cal
Products
Cal.com
CVE-2023-1647

Improper Access Control in calcom/cal.com

Improper Access Control in GitHub repository calcom/cal.com prior to 2.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Cal
Products
Cal.com
CVE-2023-37919

Cal.com not expiring old sessions after enabling 2FA

Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other device(s) stays logged in without having to verify the account owner's identity. As of time of publication, no known patches or workarounds exist.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Cal
Products
Cal.com