CVE Browser

calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization

Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID

cal.com Repository Takeover via pull_request_target Workflow

Cal.com before 5.9.9 Remote Code Execution via RSC

Cal.com through 4.7.15 Cross-Site Scripting via booking questions

Cal.com through 4.7.15 Cross-Site Scripting via booking questions

CVE-2026-16624

cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State

calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure

calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery

calcom cal.diy cross-site request forgery

Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback

Cal.com Authentication Bypass via bad TOTP + password checks

WordPress Cal.com plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Cal.com not expiring old sessions after enabling 2FA

Improper Access Control in calcom/cal.com