Vulnerabilities in calcom
15 resultsCVE-2025-71389CRITICALCal.com before 5.9.9 Remote Code Execution via RSCEPSS 1.4%CVE-2025-66489CRITICALCal.com Authentication Bypass via bad TOTP + password checksEPSS 1.0%CVE-2023-1647HIGHImproper Access Control in calcom/cal.comEPSS 0.8%CVE-2024-58354HIGHcal.com Repository Takeover via pull_request_target WorkflowEPSS 0.5%CVE-2026-23478CRITICALCal.com has an Authentication Bypass via Unvalidated Email in Custom JWT CallbackEPSS 0.5%CVE-2024-58355CRITICALCal.com through 4.7.15 Cross-Site Scripting via booking questionsEPSS 0.4%CVE-2024-58353CRITICALCal.com through 4.7.15 Cross-Site Scripting via booking questionsEPSS 0.4%CVE-2026-9349MEDIUMcalcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosureEPSS 0.4%CVE-2026-112043MEDIUMcalcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorizationEPSS 0.4%CVE-2026-63768MEDIUMcal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned StateEPSS 0.3%CVE-2023-37919MEDIUMCal.com not expiring old sessions after enabling 2FAEPSS 0.3%CVE-2026-109143MEDIUMcalcom cal.com/cal.diy Credentials delete credentials.delete privileges managementEPSS 0.2%CVE-2026-104054MEDIUMcalcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorizationEPSS 0.2%CVE-2026-9304LOWcalcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgeryEPSS 0.2%CVE-2026-9303MEDIUMcalcom cal.diy cross-site request forgeryEPSS 0.2%