Productivity

In Cal.com and Cal.diy versions up to 6.2.0 a medium severity vulnerability CVE-2026-109143 was detected. This vulnerability allows a remote attacker to bypass authorization checks and delete credentials, leading to improper privilege management. This occurs due to a flaw in the credentials.delete function within the /api/trpc/credentials/delete endpoint of the Credentials Handler component. By manipulating the teamId argument, an attacker can perform unauthorized actions on team credentials. Warning: A public exploit for this vulnerability has been disclosed, and the vendor has not yet responded or provided an official patch. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-109143.

In Documize in affected versions a high severity vulnerability CVE-2026-71234 was detected. This vulnerability allows an attacker to download attachments without proper authentication. To address this issue, users should upgrade Documize to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-71234.

In Cal versions 4.7.15 and earlier a high severity vulnerability CVE-2024-58353 was detected. This vulnerability allows an attacker to inject arbitrary HTML or JavaScript. To address this issue, users should upgrade Cal to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-58353.

In Cal.com OSS a critical severity vulnerability CVE-2026-16624 was detected. This vulnerability allows any authenticated user to steal sensitive booking data, including attendee PII and video-call passwords, from any team. To address this issue, users should upgrade Cal to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-16624.

In Cal a critical severity vulnerability CVE-2026-16624 was detected. This vulnerability allows any authenticated user to create a webhook on any team and steal booking data. To address this issue, users should upgrade Cal to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-16624.

In Cal.com versions up to and including 1.0.0 a medium severity vulnerability CVE-2025-31604 was detected. This vulnerability allows attackers to execute stored cross-site scripting (XSS) attacks by improperly neutralizing script-related HTML tags in a web page. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-31604.

In ONLYOFFICE Docs Plugin for WordPress versions up to and including 2.0.0 a medium severity vulnerability CVE-2024-11450 was detected. This vulnerability allows attackers with contributor-level access or higher to inject arbitrary web scripts into pages via the ‘onlyoffice’ shortcode. These scripts execute whenever a user accesses an injected page. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-11450.