Skip to content
OpenAdvisories

Product · Cal.com

cal.diy

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-71389 Public exploit

    Cal.com before 5.9.9 Remote Code Execution via RSC

    Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a craf…

    Cal.com cal.diy
  • Critical 9.9
    CVE-2024-58354

    cal.com Repository Takeover via pull_request_target Workflow

    cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pull_request_target trigger with the repository's default write permissions and passes them dow…

    Cal.com cal.diy
  • Critical 9.6
    CVE-2026-16624

    CVE-2026-16624

    Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, …

    Cal.com cal.diy