Advisories · Technology
calcom cal.diy.
Every CVE that names calcom cal.diy among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization
- calcom cal.com
- calcom cal.diy
- Broken access control
- CVSS 5.3 Medium
calcom cal.com/cal.diy Credentials delete credentials.delete privileges management
- calcom cal.com
- calcom cal.diy
- Privilege escalation
- CVSS 5.3 Medium
calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization
- calcom cal.diy
- Broken access control
- CVSS 10.0 CriticalCritical · CVSS 9+
Cal.com before 5.9.9 Remote Code Execution via RSC
- calcom cal.diy
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Cal.com through 4.7.15 Cross-Site Scripting via booking questions
- calcom cal.diy
- Cross-site scripting (XSS)
- CVSS 8.5 High
cal.com Repository Takeover via pull_request_target Workflow
- calcom cal.diy
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Cal.com through 4.7.15 Cross-Site Scripting via booking questions
- calcom cal.diy
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State
- calcom cal.diy
- Open redirect
- CVSS 6.9 Medium
calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure
- calcom cal.diy
- Information disclosure
- Broken access control
- CVSS 2.3 Low
calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery
- calcom cal.diy
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
calcom cal.diy cross-site request forgery
- calcom cal.diy
- Cross-site request forgery (CSRF)
- Broken access control