Known vulnerabilities in wger

Known vulnerabilities in wger

Vendor: wger Project

Software: wger

Software CPE: cpe:2.3:a:wger_project:wger:*:*:*:*:*:*:*:*

Website: https://github.com/wger-project

Total vulnerabilities: 12

Public exploits: 3

Known exploited (KEV): 0

Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Vulnerabilities (12)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU131758 - Improper Privilege Management CVE-2026-43978	CWE-269	Medium	No	No	2.6	18.05.2026	SB20260511110
#VU131757 - Authorization Bypass Through User-Controlled Key CVE-2026-43977	CWE-639	Medium	No	No	2.6	18.05.2026	SB20260511110
#VU131010 - Resource exhaustion	CWE-400	Medium	Available	No	2.6	11.05.2026	SB20260511110
#VU128292 - Incorrect Authorization CVE-2026-43948	CWE-863	Medium	No	No	2.6	28.04.2026	SB2026042848
#VU128290 - Improper Neutralization of Formula Elements in a CSV File	CWE-1236	Medium	No	No	2.6	28.04.2026	SB2026042848
#VU128289 - URL Redirection to Untrusted Site ('Open Redirect')	CWE-601	Low	No	No	2.6	28.04.2026	SB2026042848
#VU126594 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-40353	CWE-79	Low	No	No	2.5	20.04.2026	SB20260420113
#VU126593 - Missing Authorization CVE-2026-40474	CWE-862	Low	No	No	2.5	20.04.2026	SB20260420113
#VU123337 - Authorization Bypass Through User-Controlled Key CVE-2026-27838	CWE-639	Low	No	No	-	27.02.2026	SB2026022744
#VU123336 - Authorization Bypass Through User-Controlled Key CVE-2026-27839	CWE-639	Low	Available	No	-	27.02.2026	SB2026022744
#VU123335 - Authorization Bypass Through User-Controlled Key CVE-2026-27835	CWE-639	Low	Available	No	-	27.02.2026	SB2026022744
#VU93706 - Improper Restriction of Excessive Authentication Attempts CVE-2022-2650	CWE-307	High	No	No	2.2	03.07.2024	SB2024070305 SB2024070313