Login Request a demo
WG
Product
wger
by wger-project · last CVE Oct 7, 2026
18
CVEs
0
On KEV
9.9
Max CVSS
5
New 30D
Vulnerabilities18In the news0Timeline
Severity mix
Critical 1High 5Medium 11Low 1
Severity
All severities18Critical1High5Medium11Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add wger to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-86254
6.8
0%
Sep 6
wger Incomplete Authorization Fix Cross-Tenant Account Deletion
Affected: through master
CVE-2026-46438
6.5
0%
Oct 7
wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry
Affected: < 2.6
CVE-2026-86255
6.5
0%
Sep 6
wger before 2.5 Uncontrolled Resource Consumption via date_sequence
Affected: before 2.5
CVE-2026-45161
5.4
0%
Oct 7
wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
Affected: < 2.6
CVE-2026-86257
5.4
0%
Sep 6
wger before 2.6 CSV Formula Injection via member export
Affected: before 2.6
CVE-2026-86256
5.4
0%
Sep 6
wger before 2.6 Open Redirect via trainer-login next parameter
Affected: before 2.6
CVE-2026-40353
5.4
0%
Apr 17
wger: Stored XSS via Unescaped License Attribution Fields
Affected: < 2.5
CVE-2026-46437
4.8
0%
Oct 7
wger: API credentials remain valid after logout/password change
Affected: < 2.6
CVE-2026-82544
4.3
0%
Aug 30
wger-project wger Password Reset gym.py reset_user_password cross-site request forgery
Affected: 2.6.0-alpha2
CVE-2026-27839
4.3
0%
Feb 26
wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup
Affected: <= 2.4
CVE-2026-27835
4.3
0%
Feb 26
wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data
Affected: <= 2.4
Showing 11