# wger (PyPI) vulnerabilities

Source: https://junglewise.ai/threats/technologies/wger  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/wger.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 22 vulnerabilities in wger (PyPI): 0 in the last 7 days and 10 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-46438, was published on 7 October 2026. Nothing in the last four weeks, down from 5 vulnerabilities in the four before.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 10
- All time: 22 (1 critical, 0 exploited in the wild)

## About wger (PyPI)

Python-based fitness and strength training exercise database and workout tracking application.

## Latest wger (PyPI) vulnerabilities

- [CVE-2026-46438: wger authorization bypass in workout log entry creation](https://junglewise.ai/threats/cve-2026-46438-wger-cross-user-data-corruption-via-missing-ownership-check-on) (medium, CVSS 6.5, published 7 Oct 2026)
- [CVE-2026-46434: wger Trainer privilege escalation in user deactivation](https://junglewise.ai/threats/cve-2026-46434-wger-trainer-privilege-escalation-improper-privilege-management) (high, CVSS 7.1, published 7 Oct 2026)
- [CVE-2026-46437: wger API credentials remain valid after logout/password change](https://junglewise.ai/threats/cve-2026-46437-wger-api-credentials-remain-valid-after-logout-password-change) (medium, CVSS 4.8, published 7 Oct 2026)
- [CVE-2026-45161: wger trainer_login CSRF bypass via GET request](https://junglewise.ai/threats/cve-2026-45161-wger-trainer-login-accepts-get-csrf-bypass-enables-forced-session) (medium, CVSS 5.4, published 7 Oct 2026)
- [CVE-2026-43976: wger gym-scope guard bypass allows cross-tenant admin notes leak](https://junglewise.ai/threats/cve-2026-43976-wger-cross-tenant-admin-notes-contracts-leak-via-gym-none-bypass) (high, CVSS 7.1, published 7 Oct 2026)
- [CVE-2026-86257: wger CSV/TSV formula injection in gym member export](https://junglewise.ai/threats/cve-2026-86257-wger-csv-tsv-formula-injection-in-gym-member-export) (medium, CVSS 5.4, published 6 Sep 2026)
- [CVE-2026-86256: wger trainer_login open redirect in next parameter](https://junglewise.ai/threats/cve-2026-86256-wger-trainer-login-open-redirect-in-next-parameter) (medium, CVSS 5.4, published 6 Sep 2026)
- [CVE-2026-86255: wger Uncontrolled Resource Consumption in date_sequence](https://junglewise.ai/threats/cve-2026-86255-wger-uncontrolled-resource-consumption-in-date-sequence) (medium, CVSS 6.5, published 6 Sep 2026)
- [CVE-2026-86254: wger incomplete authorization bypass in user management views](https://junglewise.ai/threats/cve-2026-86254-wger-incomplete-authorization-bypass-in-user-management-views) (medium, CVSS 6.8, published 6 Sep 2026)
- [CVE-2026-82544: Wger password reset cross-site request forgery](https://junglewise.ai/threats/cve-2026-82544-wger-password-reset-cross-site-request-forgery) (medium, CVSS 4.3, published 30 Aug 2026)
- [CVE-2026-43978: wger privilege escalation in trainer-login session chaining](https://junglewise.ai/threats/cve-2026-43978-wger-privilege-escalation-in-trainer-login-session-chaining) (high, CVSS 8.1, published 16 Jul 2026)
- [CVE-2026-43977: wger IDOR in RoutineViewSet logs and stats endpoints](https://junglewise.ai/threats/cve-2026-43977-wger-idor-in-routineviewset-logs-and-stats-endpoints) (high, CVSS 7.5, published 16 Jul 2026)
- [CVE-2026-27839: PYSEC-2026-3422 - wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup](https://junglewise.ai/threats/cve-2026-27839-wger-idor-in-nutritional-values-endpoints-exposes-private-dietary) (low, CVSS 3.1, published 13 Jul 2026)
- [CVE-2026-27838: PYSEC-2026-3418 - wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data](https://junglewise.ai/threats/cve-2026-27838-wger-idor-via-user-unscoped-cache-keys-on-routine-api-actions) (low, CVSS 3.1, published 13 Jul 2026)
- [CVE-2026-27835: PYSEC-2026-3423 - wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data](https://junglewise.ai/threats/cve-2026-27835-wger-idor-in-repetitionsconfig-and-maxrepetitionsconfig-api-leak) (low, CVSS 3.1, published 13 Jul 2026)
- [CVE-2022-2650: PYSEC-2026-573 - wger vulnerable to brute force attempts](https://junglewise.ai/threats/cve-2022-2650-wger-vulnerable-to-brute-force-attempts) (low, CVSS 3.1, published 29 Jun 2026)
- [wger cross-tenant account deletion and deactivation in core user views](https://junglewise.ai/threats/wger-cross-tenant-account-deletion-and-deactivation-in-core-user-views-07337a2a) (high, CVSS 8.5, published 20 May 2026)
- [CVE-2026-43948: wger Incorrect Authorization in password reset and user edit views](https://junglewise.ai/threats/cve-2026-43948-wger-incorrect-authorization-in-password-reset-via-gym-bypass) (critical, CVSS 9.9, published 12 May 2026)
- [CVE-2026-40353: wger has Stored XSS via Unescaped License Attribution Fields](https://junglewise.ai/threats/cve-2026-40353-wger-has-stored-xss-via-unescaped-license-attribution-fields) (medium, CVSS 5.4, published 16 Apr 2026)
- [CVE-2026-40474: wger has Broken Access Control in Global Gym Configuration Update Endpoint](https://junglewise.ai/threats/cve-2026-40474-wger-has-broken-access-control-in-global-gym-configuration-update) (high, CVSS 7.6, published 16 Apr 2026)
- [CVE-2023-38759: wger Workout Manager Cross-Site Request Forgery vulnerability](https://junglewise.ai/threats/cve-2023-38759-wger-workout-manager-cross-site-request-forgery-vulnerability) (low, CVSS 3.1, published 8 Aug 2023)
- [CVE-2023-38758: wger Workout Manager Cross-site Scripting vulnerability](https://junglewise.ai/threats/cve-2023-38758-wger-workout-manager-cross-site-scripting-vulnerability) (low, CVSS 3.1, published 8 Aug 2023)

## Most severe wger (PyPI) vulnerabilities

- [CVE-2026-43948: wger Incorrect Authorization in password reset and user edit views](https://junglewise.ai/threats/cve-2026-43948-wger-incorrect-authorization-in-password-reset-via-gym-bypass) (critical, CVSS 9.9, published 12 May 2026)
- [wger cross-tenant account deletion and deactivation in core user views](https://junglewise.ai/threats/wger-cross-tenant-account-deletion-and-deactivation-in-core-user-views-07337a2a) (high, CVSS 8.5, published 20 May 2026)
- [CVE-2026-43978: wger privilege escalation in trainer-login session chaining](https://junglewise.ai/threats/cve-2026-43978-wger-privilege-escalation-in-trainer-login-session-chaining) (high, CVSS 8.1, published 16 Jul 2026)
- [CVE-2026-40474: wger has Broken Access Control in Global Gym Configuration Update Endpoint](https://junglewise.ai/threats/cve-2026-40474-wger-has-broken-access-control-in-global-gym-configuration-update) (high, CVSS 7.6, published 16 Apr 2026)
- [CVE-2026-43977: wger IDOR in RoutineViewSet logs and stats endpoints](https://junglewise.ai/threats/cve-2026-43977-wger-idor-in-routineviewset-logs-and-stats-endpoints) (high, CVSS 7.5, published 16 Jul 2026)
- [CVE-2026-46434: wger Trainer privilege escalation in user deactivation](https://junglewise.ai/threats/cve-2026-46434-wger-trainer-privilege-escalation-improper-privilege-management) (high, CVSS 7.1, published 7 Oct 2026)
- [CVE-2026-43976: wger gym-scope guard bypass allows cross-tenant admin notes leak](https://junglewise.ai/threats/cve-2026-43976-wger-cross-tenant-admin-notes-contracts-leak-via-gym-none-bypass) (high, CVSS 7.1, published 7 Oct 2026)
- [CVE-2026-86254: wger incomplete authorization bypass in user management views](https://junglewise.ai/threats/cve-2026-86254-wger-incomplete-authorization-bypass-in-user-management-views) (medium, CVSS 6.8, published 6 Sep 2026)
- [CVE-2026-86255: wger Uncontrolled Resource Consumption in date_sequence](https://junglewise.ai/threats/cve-2026-86255-wger-uncontrolled-resource-consumption-in-date-sequence) (medium, CVSS 6.5, published 6 Sep 2026)
- [CVE-2026-46438: wger authorization bypass in workout log entry creation](https://junglewise.ai/threats/cve-2026-46438-wger-cross-user-data-corruption-via-missing-ownership-check-on) (medium, CVSS 6.5, published 7 Oct 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 5 vulnerabilities in the four before.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 1 | 0 | 0 |
| 31 Aug 2026 | 4 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 5 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other PyPI technologies

- [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities
- [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities
- [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities
- [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities
- [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities
- [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities
- [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities
- [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities
- [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities
- [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities
- [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities
- [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "wger (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/wger, 13 November 2026.