https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T03:48:31.454393+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-16624 CVE-2026-16624 — CVE-2026-16624 2026-10-08T03:48:31.469971+00:00

Affected: Cal.com Cal.diy

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.