Calcom / Cal.com

3 CVEs

CVE ID	Description	Severity	CVSS	Published
CVE-2026-23478	Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback	CRITICAL	10.0	Jan 13, 2026
CVE-2025-66489	Cal.com Authentication Bypass via bad TOTP + password checks	CRITICAL	9.9	Dec 3, 2025
CVE-2025-31604	WordPress Cal.com plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability	MEDIUM	6.5	Mar 31, 2025
CVE-2023-37919	Cal.com not expiring old sessions after enabling 2FA	MEDIUM	6.5	Jul 25, 2023

Rows per page

Showing 1 to 3 of 3 CVEs