Do Son Critical Cal.com flaw (CVE-2026-23478) allows full account takeover via a single API call. CVSS 10.0. Update self-hosted instances to v6.0.7 immediately.
JWT Manipulation
Apache StreamPipes patches CVE-2025-47411, a logic flaw allowing users to manipulate JWT tokens and hijack admin accounts. Update to v0.98.0 now!