Cal.com vulnerabilities
We track 2 vulnerabilities in Cal.com products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 12, 2026.
2vulnerabilities
1critical
1high
0exploited
9.3average CVSS score
Latest Cal.com vulnerabilities
- 8.9 High severity
Cal.com Self-Hosted (Cal.diy): Improper Neutralization of Input During Web Page Generation
Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without
- 9.6 Critical severity
Cal.diy: Authorization Bypass Through User-Controlled Key
Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, a