[ Vendor · 5 CVEs ]
wger-project
CVEs affecting wger-project published in the last 30 days, plus any wger-project CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-45161 | 7 Oct 2026 | CVSS 5.4 | wger: trainer_login accepts GET - CSRF bypass enables forced session rebindingwger is a free, open-source workout and fitness manager. Prior to version 2.6, the `trainer_login` view in wger accepts GET requests and executes… | |
| CVE-2026-46434 | 7 Oct 2026 | CVSS 7.1 | wger: Trainer Privilege Escalation - Improper Privilege Managementwger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate any… | |
| CVE-2026-46437 | 7 Oct 2026 | CVSS 4.8 | wger: API credentials remain valid after logout/password changewger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of `wger`… | |
| CVE-2026-46438 | 7 Oct 2026 | CVSS 6.5 | wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entrywger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries… | |
| CVE-2026-43976 | 7 Oct 2026 | CVSS 7.1 | wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard… |