Exploitation ongoing with high activity in latest observed window (2 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-23 | 3 | Disclosure2Patch1 |
| 2026-07-24 | 2 | Disclosure1Exploit1 |
| 2026-07-25 | 1 | Active Exploitation1 |
| 2026-07-27 | 1 | Patch1 |
| 2026-08-31 | 2 | Exploit2 |
[CVE] CVE-2025-71389 [CRITICAL/PoC] #Cal.com before 5.9.9 Remote Code Execution via RSC ⚠️ Recorded Exploit Available 🔗 https://exploitgrid.net/cve/CVE-2025-71389
Post summary
CVE-2025-71389 is a critical RCE affecting Cal.com versions before 5.9.9, with a recorded PoC and exploit code available on ExploitGrid.
🛡️ #ExploitGrid Daily #Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2025-71338 - EXPLOIT CVE-2025-71389 - EXPLOIT CVE-2026-0092 - EXPLOIT CVE-2026-0848 - EXPLOIT CVE-2026-12485 - EXPLOIT ..🧵👇
Post summary
The digest lists several CVEs flagged as exploitable but provides no PoC, details, or patch information.
🚨 http://Cal.com / Next.js RCE — CVSS 10.0 CVE-2025-71389: Unauthenticated RCE via React Server Components deserialization. CISA KEV active. Affects http://cal.diy < 5.9.9. Patch to 5.9.9 NOW. → http://threataft.com/articles/calcom-cve-2025-71389-rce #cybersecurity #infosec #NextJS #Calcom
Post summary
CVE-2025-71389 is a critical unauthenticated RCE affecting Cal.com/Next.js, actively exploited per CISA KEV, with an immediate patch to 5.9.9 available and a likely PoC referenced via the provided link.
CVE-2025-71389 Unauthenticated Remote Code Execution in http://Cal.com Before 5.9.9 via RSC Deserialization https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-71389
Post summary
The text announces a new CVE (CVE-2025-71389) describing an unauthenticated RCE in Cal.com versions before 5.9.9 caused by RSC deserialization, but provides no PoC, patch, or evidence of active exploitation.
🚨 CVE-2025-71389 — CVSS 10/10 ██████████ http://Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/XTgmVz8G44
Post summary
CVE‑2025‑71389 is a critical unauthenticated remote code execution vulnerability in cal.com versions before 5.9.9; an immediate patch is available and must be applied.
CVE-2025-71389 http://Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RS… https://www.cve.org/CVERecord?id=CVE-2025-71389
Post summary
CVE‑2025‑71389 is disclosed as an unauthenticated remote code execution vulnerability in versions of Cal.com prior to 5.9.9 due to a bundled Next.js with vulnerable React Server Components.
🗓️ http://Cal.com (http://cal.diy) users: patch to 5.9.9 now. CVE-2025-71389 is a CVSS 10 unauth RCE — Next.js React Server Components deserialize untrusted input, no auth required. #cybersecurity #ciso #vulnerabilities https://secalerts.co/vulnerability/CVE-2025-71389?utm_campaign=x https://t.co/k27a9jFYGj
Post summary
The tweet announces a CVE‑2025‑71389 that causes a CVSS 10 unauthenticated RCE in Next.js React Server Components and urges Cal.com users to apply patch 5.9.9.
🚨 CRITICAL - Unauthenticated RCE via Next.js React Server Components deserialization (CVE-2025-71389) http://Cal.com (calcom/cal.diy) is vulnerable to unauthenticated remote code execution due to a bundled vulnerable Next.js version affecting React Server Components (RSC) request handling. The root cause is unsafe deserialization of attacker-controlled input during server-side processing (inherited from upstream Next.js CVE-2025-55182). An attacker can exploit this by sending a crafted RSC request to the exposed http://Cal.com server endpoint with no authentication, privileges, or user interaction required. Successful exploitation can result in full server compromise, arbitrary code execution, data theft, lateral movement, and service takeover. 👉 Affected: http://cal.diy < 5.9.9 | Upgrade to 5.9.9
Post summary
The post highlights a critical unauthenticated remote code execution flaw in Cal.com due to unsafe deserialization in Next.js RSC, describes the exploit method, warns of severe impact, and urges an upgrade to version 5.9.9.
🚨*CVE* CVE-2025-71389 http://Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RS… https://www.cve.org/CVERecord?id=CVE-2025-71389 ----- Traducción: CV… http://infoflow.cloud`
Post summary
The post announces CVE‑2025‑71389, describing an unauthenticated remote code execution flaw in Cal.com (version <5.9.9) caused by an outdated Next.js component; no PoC, exploit, or patch is mentioned.