{"schema_version":1,"title":"wger (PyPI) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 18 vulnerabilities in wger (PyPI): 0 in the last 7 days and 11 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-86257, was published on 6 September 2026.","url":"https://junglewise.ai/threats/technologies/wger","json_url":"https://junglewise.ai/threats/technologies/wger.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/wger","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":4,"all_time":18,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":5,"last_90_days":11,"last_365_days":16},"latest":[{"cve":"CVE-2026-86257","cvss":5.4,"epss":0.0028,"slug":"cve-2026-86257-wger-csv-tsv-formula-injection-in-gym-member-export","title":"wger CSV/TSV formula injection in gym member export","severity":"medium","exploited":false,"published_at":"2026-09-06T12:17:16.7+00:00","url":"https://junglewise.ai/threats/cve-2026-86257-wger-csv-tsv-formula-injection-in-gym-member-export"},{"cve":"CVE-2026-86256","cvss":5.4,"epss":0.0023,"slug":"cve-2026-86256-wger-trainer-login-open-redirect-in-next-parameter","title":"wger trainer_login open redirect in next parameter","severity":"medium","exploited":false,"published_at":"2026-09-06T12:17:16.567+00:00","url":"https://junglewise.ai/threats/cve-2026-86256-wger-trainer-login-open-redirect-in-next-parameter"},{"cve":"CVE-2026-86255","cvss":6.5,"epss":0.0044,"slug":"cve-2026-86255-wger-uncontrolled-resource-consumption-in-date-sequence","title":"wger Uncontrolled Resource Consumption in date_sequence","severity":"medium","exploited":false,"published_at":"2026-09-06T12:17:16.433+00:00","url":"https://junglewise.ai/threats/cve-2026-86255-wger-uncontrolled-resource-consumption-in-date-sequence"},{"cve":"CVE-2026-86254","cvss":6.8,"epss":0.0037,"slug":"cve-2026-86254-wger-incomplete-authorization-bypass-in-user-management-views","title":"wger incomplete authorization bypass in user management views","severity":"medium","exploited":false,"published_at":"2026-09-06T12:17:16.297+00:00","url":"https://junglewise.ai/threats/cve-2026-86254-wger-incomplete-authorization-bypass-in-user-management-views"},{"cve":"CVE-2026-82544","cvss":4.3,"epss":0.0024,"slug":"cve-2026-82544-wger-password-reset-cross-site-request-forgery","title":"Wger password reset cross-site request forgery","severity":"medium","exploited":false,"published_at":"2026-08-30T14:17:02.627+00:00","url":"https://junglewise.ai/threats/cve-2026-82544-wger-password-reset-cross-site-request-forgery"},{"cve":"CVE-2026-43978","cvss":8.1,"epss":0.0037,"slug":"cve-2026-43978-wger-privilege-escalation-in-trainer-login-session-chaining","title":"wger privilege escalation in trainer-login session chaining","severity":"high","exploited":false,"published_at":"2026-07-16T23:16:16.31+00:00","url":"https://junglewise.ai/threats/cve-2026-43978-wger-privilege-escalation-in-trainer-login-session-chaining"},{"cve":"CVE-2026-43977","cvss":7.5,"epss":0.0039,"slug":"cve-2026-43977-wger-idor-in-routineviewset-logs-and-stats-endpoints","title":"wger IDOR in RoutineViewSet logs and stats endpoints","severity":"high","exploited":false,"published_at":"2026-07-16T23:16:16.167+00:00","url":"https://junglewise.ai/threats/cve-2026-43977-wger-idor-in-routineviewset-logs-and-stats-endpoints"},{"cve":"CVE-2026-27839","cvss":3.1,"epss":0.0031,"slug":"cve-2026-27839-wger-idor-in-nutritional-values-endpoints-exposes-private-dietary","title":"PYSEC-2026-3422 - wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup","severity":"low","exploited":false,"published_at":"2026-07-13T14:36:39.598915+00:00","url":"https://junglewise.ai/threats/cve-2026-27839-wger-idor-in-nutritional-values-endpoints-exposes-private-dietary"},{"cve":"CVE-2026-27838","cvss":3.1,"epss":0.0025,"slug":"cve-2026-27838-wger-idor-via-user-unscoped-cache-keys-on-routine-api-actions","title":"PYSEC-2026-3418 - wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data","severity":"low","exploited":false,"published_at":"2026-07-13T14:36:39.533532+00:00","url":"https://junglewise.ai/threats/cve-2026-27838-wger-idor-via-user-unscoped-cache-keys-on-routine-api-actions"},{"cve":"CVE-2026-27835","cvss":3.1,"epss":0.003,"slug":"cve-2026-27835-wger-idor-in-repetitionsconfig-and-maxrepetitionsconfig-api-leak","title":"PYSEC-2026-3423 - wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data","severity":"low","exploited":false,"published_at":"2026-07-13T14:36:39.470269+00:00","url":"https://junglewise.ai/threats/cve-2026-27835-wger-idor-in-repetitionsconfig-and-maxrepetitionsconfig-api-leak"},{"cve":"CVE-2022-2650","cvss":3.1,"epss":0.0071,"slug":"cve-2022-2650-wger-vulnerable-to-brute-force-attempts","title":"PYSEC-2026-573 - wger vulnerable to brute force attempts","severity":"low","exploited":false,"published_at":"2026-06-29T11:50:33.145504+00:00","url":"https://junglewise.ai/threats/cve-2022-2650-wger-vulnerable-to-brute-force-attempts"},{"cvss":8.5,"slug":"wger-cross-tenant-account-deletion-and-deactivation-in-core-user-views-07337a2a","title":"wger cross-tenant account deletion and deactivation in core user views","severity":"high","exploited":false,"published_at":"2026-05-20T15:37:26+00:00","url":"https://junglewise.ai/threats/wger-cross-tenant-account-deletion-and-deactivation-in-core-user-views-07337a2a"},{"cvss":6.5,"slug":"wger-uncontrolled-resource-consumption-in-workout-routine-date-sequence-c791849a","title":"wger uncontrolled resource consumption in workout routine date sequence","severity":"medium","exploited":false,"published_at":"2026-05-13T15:33:38+00:00","url":"https://junglewise.ai/threats/wger-uncontrolled-resource-consumption-in-workout-routine-date-sequence-c791849a"},{"cve":"CVE-2026-43948","cvss":9.9,"epss":0.0044,"slug":"cve-2026-43948-wger-incorrect-authorization-in-password-reset-via-gym-bypass","title":"wger Incorrect Authorization in password reset and user edit views","severity":"critical","exploited":false,"published_at":"2026-05-12T22:16:35.197+00:00","url":"https://junglewise.ai/threats/cve-2026-43948-wger-incorrect-authorization-in-password-reset-via-gym-bypass"},{"cve":"CVE-2026-40353","cvss":5.4,"epss":0.0025,"slug":"cve-2026-40353-wger-has-stored-xss-via-unescaped-license-attribution-fields","title":"wger has Stored XSS via Unescaped License Attribution Fields","severity":"medium","exploited":false,"published_at":"2026-04-16T01:37:21+00:00","url":"https://junglewise.ai/threats/cve-2026-40353-wger-has-stored-xss-via-unescaped-license-attribution-fields"},{"cve":"CVE-2026-40474","cvss":7.6,"epss":0.004,"slug":"cve-2026-40474-wger-has-broken-access-control-in-global-gym-configuration-update","title":"wger has Broken Access Control in Global Gym Configuration Update Endpoint","severity":"high","exploited":false,"published_at":"2026-04-16T01:35:16+00:00","url":"https://junglewise.ai/threats/cve-2026-40474-wger-has-broken-access-control-in-global-gym-configuration-update"},{"cve":"CVE-2023-38758","cvss":3.1,"epss":0.0059,"slug":"cve-2023-38758-wger-workout-manager-cross-site-scripting-vulnerability","title":"PYSEC-2023-143 - Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the licens","severity":"low","exploited":false,"published_at":"2023-08-08T16:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-38758-wger-workout-manager-cross-site-scripting-vulnerability"},{"cve":"CVE-2023-38759","cvss":3.1,"epss":0.004,"slug":"cve-2023-38759-wger-workout-manager-cross-site-request-forgery-vulnerability","title":"PYSEC-2023-144 - Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via","severity":"low","exploited":false,"published_at":"2023-08-08T16:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-38759-wger-workout-manager-cross-site-request-forgery-vulnerability"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"open-webui (PyPI)","slug":"open-webui","vulnerabilities":156,"url":"https://junglewise.ai/threats/technologies/open-webui"},{"name":"nltk (PyPI)","slug":"nltk","vulnerabilities":74,"url":"https://junglewise.ai/threats/technologies/nltk"},{"name":"picklescan (PyPI)","slug":"picklescan","vulnerabilities":74,"url":"https://junglewise.ai/threats/technologies/picklescan"},{"name":"openbabel (PyPI)","slug":"openbabel","vulnerabilities":48,"url":"https://junglewise.ai/threats/technologies/openbabel"},{"name":"apache-superset (PyPI)","slug":"apache-superset","vulnerabilities":44,"url":"https://junglewise.ai/threats/technologies/apache-superset"},{"name":"apache-airflow (PyPI)","slug":"apache-airflow","vulnerabilities":40,"url":"https://junglewise.ai/threats/technologies/apache-airflow"},{"name":"tensorflow-gpu (PyPI)","slug":"tensorflow-gpu","vulnerabilities":37,"url":"https://junglewise.ai/threats/technologies/tensorflow-gpu"},{"name":"tensorflow-cpu (PyPI)","slug":"tensorflow-cpu","vulnerabilities":34,"url":"https://junglewise.ai/threats/technologies/tensorflow-cpu"},{"name":"weblate (PyPI)","slug":"weblate","vulnerabilities":33,"url":"https://junglewise.ai/threats/technologies/weblate"},{"name":"mcp-atlassian (PyPI)","slug":"mcp-atlassian","vulnerabilities":30,"url":"https://junglewise.ai/threats/technologies/mcp-atlassian"},{"name":"crawl4ai (PyPI)","slug":"crawl4ai","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/crawl4ai"},{"name":"moin (PyPI)","slug":"moin","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/moin"}],"technology":{"hub":true,"name":"wger (PyPI)","slug":"wger","vendor":{"name":"PyPI","slug":"pypi","url":"https://junglewise.ai/threats/vendors/pypi"},"aliases":[],"homepage":"https://wger.de/","repo_url":"https://github.com/wger-project/wger","description":"A fitness and workout management application for tracking exercises and nutrition.","url":"https://junglewise.ai/threats/technologies/wger"},"most_severe":[{"cve":"CVE-2026-43948","cvss":9.9,"epss":0.0044,"slug":"cve-2026-43948-wger-incorrect-authorization-in-password-reset-via-gym-bypass","title":"wger Incorrect Authorization in password reset and user edit views","severity":"critical","exploited":false,"published_at":"2026-05-12T22:16:35.197+00:00","url":"https://junglewise.ai/threats/cve-2026-43948-wger-incorrect-authorization-in-password-reset-via-gym-bypass"},{"cvss":8.5,"slug":"wger-cross-tenant-account-deletion-and-deactivation-in-core-user-views-07337a2a","title":"wger cross-tenant account deletion and deactivation in core user views","severity":"high","exploited":false,"published_at":"2026-05-20T15:37:26+00:00","url":"https://junglewise.ai/threats/wger-cross-tenant-account-deletion-and-deactivation-in-core-user-views-07337a2a"},{"cve":"CVE-2026-43978","cvss":8.1,"epss":0.0037,"slug":"cve-2026-43978-wger-privilege-escalation-in-trainer-login-session-chaining","title":"wger privilege escalation in trainer-login session chaining","severity":"high","exploited":false,"published_at":"2026-07-16T23:16:16.31+00:00","url":"https://junglewise.ai/threats/cve-2026-43978-wger-privilege-escalation-in-trainer-login-session-chaining"},{"cve":"CVE-2026-40474","cvss":7.6,"epss":0.004,"slug":"cve-2026-40474-wger-has-broken-access-control-in-global-gym-configuration-update","title":"wger has Broken Access Control in Global Gym Configuration Update Endpoint","severity":"high","exploited":false,"published_at":"2026-04-16T01:35:16+00:00","url":"https://junglewise.ai/threats/cve-2026-40474-wger-has-broken-access-control-in-global-gym-configuration-update"},{"cve":"CVE-2026-43977","cvss":7.5,"epss":0.0039,"slug":"cve-2026-43977-wger-idor-in-routineviewset-logs-and-stats-endpoints","title":"wger IDOR in RoutineViewSet logs and stats endpoints","severity":"high","exploited":false,"published_at":"2026-07-16T23:16:16.167+00:00","url":"https://junglewise.ai/threats/cve-2026-43977-wger-idor-in-routineviewset-logs-and-stats-endpoints"},{"cve":"CVE-2026-86254","cvss":6.8,"epss":0.0037,"slug":"cve-2026-86254-wger-incomplete-authorization-bypass-in-user-management-views","title":"wger incomplete authorization bypass in user management views","severity":"medium","exploited":false,"published_at":"2026-09-06T12:17:16.297+00:00","url":"https://junglewise.ai/threats/cve-2026-86254-wger-incomplete-authorization-bypass-in-user-management-views"},{"cve":"CVE-2026-86255","cvss":6.5,"epss":0.0044,"slug":"cve-2026-86255-wger-uncontrolled-resource-consumption-in-date-sequence","title":"wger Uncontrolled Resource Consumption in date_sequence","severity":"medium","exploited":false,"published_at":"2026-09-06T12:17:16.433+00:00","url":"https://junglewise.ai/threats/cve-2026-86255-wger-uncontrolled-resource-consumption-in-date-sequence"},{"cvss":6.5,"slug":"wger-uncontrolled-resource-consumption-in-workout-routine-date-sequence-c791849a","title":"wger uncontrolled resource consumption in workout routine date sequence","severity":"medium","exploited":false,"published_at":"2026-05-13T15:33:38+00:00","url":"https://junglewise.ai/threats/wger-uncontrolled-resource-consumption-in-workout-routine-date-sequence-c791849a"},{"cve":"CVE-2026-86257","cvss":5.4,"epss":0.0028,"slug":"cve-2026-86257-wger-csv-tsv-formula-injection-in-gym-member-export","title":"wger CSV/TSV formula injection in gym member export","severity":"medium","exploited":false,"published_at":"2026-09-06T12:17:16.7+00:00","url":"https://junglewise.ai/threats/cve-2026-86257-wger-csv-tsv-formula-injection-in-gym-member-export"},{"cve":"CVE-2026-40353","cvss":5.4,"epss":0.0025,"slug":"cve-2026-40353-wger-has-stored-xss-via-unescaped-license-attribution-fields","title":"wger has Stored XSS via Unescaped License Attribution Fields","severity":"medium","exploited":false,"published_at":"2026-04-16T01:37:21+00:00","url":"https://junglewise.ai/threats/cve-2026-40353-wger-has-stored-xss-via-unescaped-license-attribution-fields"}],"generated_at":"2026-09-26T13:07:00.120236+00:00"}