Medium
CVE-2026-46438
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 20
Reset filters
High
CVE-2026-46434
wger: Trainer Privilege Escalation - Improper Privilege Management
Medium
CVE-2026-46437
wger: API credentials remain valid after logout/password change
Medium
CVE-2026-45161
wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
High
CVE-2026-43976
wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
High
CVE-2026-43977
wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API
High
CVE-2026-43978
wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager
High
CVE-2026-40474
wger has Broken Access Control in Global Gym Configuration Update Endpoint
Medium
CVE-2026-40353
wger has Stored XSS via Unescaped License Attribution Fields
Medium
CVE-2026-27835
wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data
Low
CVE-2026-27838
wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data
Medium
CVE-2026-27839
wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup
High
ghsa-mw8f-w6p8-xrf4
wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None
Medium
CVE-2026-86255
wger has an Uncontrolled Resource Consumption issue
Medium
CVE-2026-86256
wger: trainer_login open redirect - ?next= parameter not validated against host
Critical
CVE-2026-43948
wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
High
CVE-2026-86257
wger: CSV/TSV formula injection in gym member export (first_name/last_name)
High
CVE-2023-38759
Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templa
Medium
CVE-2023-38758
Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the license_author field in the add-ingredient function in the templat
Critical
CVE-2022-2650
wger vulnerable to brute force attempts
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.