wger-project wger

• CVE-2026-46438 Medium 6.5 wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry 0.2%
• CVE-2026-46437 Medium 4.8 wger: API credentials remain valid after logout/password change 0.2%
• CVE-2026-46434 High 7.1 wger: Trainer Privilege Escalation - Improper Privilege Management 0.2%
• CVE-2026-45161 Medium 5.4 wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding <0.1%
• CVE-2026-43976 High 7.1 wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views) 0.2%
• CVE-2026-86257 Medium 5.4 wger before 2.6 CSV Formula Injection via member export 0.3%
• CVE-2026-86256 Medium 5.4 wger before 2.6 Open Redirect via trainer-login next parameter 0.2%
• CVE-2026-86255 Medium 6.5 wger before 2.5 Uncontrolled Resource Consumption via date_sequence 0.4%
• CVE-2026-86254 Medium 6.8 wger Incomplete Authorization Fix Cross-Tenant Account Deletion 0.4%
• CVE-2026-82544 Medium 4.3 wger-project wger Password Reset gym.py reset_user_password cross-site request forgery 0.2%
• CVE-2026-43977 High 7.5 wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API 0.3%
• CVE-2026-43978 High 8.1 wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers 0.3%
• CVE-2026-43948 Critical 9.9 wger: cross-tenant password reset and plaintext disclosure via gym=None bypass 0.4%
• CVE-2026-40474 High 7.6 wger has Broken Access Control in the Global Gym Configuration Update Endpoint 0.3%
• CVE-2026-40353 Medium 5.1 wger: Stored XSS via Unescaped License Attribution Fields 0.2%
• CVE-2026-27839 Medium 4.3 wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup 0.3%
• CVE-2026-27838 Low 3.1 wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data 0.3%
• CVE-2026-27835 Medium 4.3 wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data 0.3%