Cal
Monthly
Cal.com scheduling software (3.1.6 to 6.0.7) has a critical authentication bypass in the NextAuth JWT callback. Attackers can gain full access to any user account by supplying a target email via session.update(). Fixed in 6.0.7.
A remote code execution vulnerability in Cal.com (CVSS 9.8) that allows an attacker. Risk factors: public PoC available.
Cal.com is open-source scheduling software. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Access Control in GitHub repository calcom/cal.com prior to 2.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cal.com scheduling software (3.1.6 to 6.0.7) has a critical authentication bypass in the NextAuth JWT callback. Attackers can gain full access to any user account by supplying a target email via session.update(). Fixed in 6.0.7.
A remote code execution vulnerability in Cal.com (CVSS 9.8) that allows an attacker. Risk factors: public PoC available.
Cal.com is open-source scheduling software. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Access Control in GitHub repository calcom/cal.com prior to 2.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.