calcom has 4 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 5.8 (medium). Most affected products: cal.com (2), cal.diy (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.8
- Publish → KEV
- —
- Last 90 days
- 3 prev 1
Worst active — by depth score
CVE-2026-112043Medium· 6.3calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization47CVE-2026-104054Medium· 6.3A security flaw has been discovered in calcom cal.diy up to 6.2.047CVE-2026-109143Medium· 5.4A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.042CVE-2026-63768Medium· 4.3cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters24
calcom vulnerabilities
CVEs affecting calcom, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-112043Medium· 6.3PoCcalcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization
A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manip…
CVE-2026-109143Medium· 5.4PoCA vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0
A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the …
CVE-2026-104054Medium· 6.3PoCA security flaw has been discovered in calcom cal.diy up to 6.2.0
A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in …
CVE-2026-63768Medium· 4.3cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigne…