Known vulnerabilities in wger

Vendor: wger Project
Software: wger
Software CPE: cpe:2.3:a:wger_project:wger:*:*:*:*:*:*:*:*
Website: https://github.com/wger-project
Total vulnerabilities: 17
Public exploits: 3
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting wger wger is affected by 17 known vulnerabilities: 1 high, 5 medium, 11 low Critical High Medium Low

Vulnerabilities (17)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU153255 - Improper Authorization
CVE-2026-86254		 CWE-285 Low
No
No
 2.7 05.10.2026 SB2026100527
#VU153254 - Incorrect Authorization
CVE-2026-43976		 CWE-863 Low
No
No
 2.6 05.10.2026 SB20260511110
#VU153253 - Cross-Site Request Forgery (CSRF)
CVE-2026-45161		 CWE-352 Low
No
No
 2.6 05.10.2026 SB20260511110
#VU153252 - Authorization Bypass Through User-Controlled Key
CVE-2026-46438		 CWE-639 Low
No
No
 2.6 05.10.2026 SB20260511110
#VU153251 - Improper Privilege Management
CVE-2026-46434		 CWE-269 Low
No
No
 2.6 05.10.2026 SB20260511110
#VU131758 - Improper Privilege Management
CVE-2026-43978		 CWE-269 Medium
No
No
 2.6 18.05.2026 SB20260511110
#VU131757 - Authorization Bypass Through User-Controlled Key
CVE-2026-43977		 CWE-639 Medium
No
No
 2.6 18.05.2026 SB20260511110
#VU131010 - Resource exhaustion
CVE-2026-86255		 CWE-400 Medium
Available
No
 2.6 11.05.2026 SB20260511110
#VU128292 - Incorrect Authorization
CVE-2026-43948		 CWE-863 Medium
No
No
 2.6 28.04.2026 SB2026042848
#VU128290 - Improper Neutralization of Formula Elements in a CSV File
CVE-2026-86257		 CWE-1236 Medium
No
No
 2.6 28.04.2026 SB2026042848
#VU128289 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2026-86256		 CWE-601 Low
No
No
 2.6 28.04.2026 SB2026042848
#VU126594 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-40353		 CWE-79 Low
No
No
 2.5 20.04.2026 SB20260420113
#VU126593 - Missing Authorization
CVE-2026-40474		 CWE-862 Low
No
No
 2.5 20.04.2026 SB20260420113
#VU123337 - Authorization Bypass Through User-Controlled Key
CVE-2026-27838		 CWE-639 Low
No
No
 - 27.02.2026 SB2026022744
#VU123336 - Authorization Bypass Through User-Controlled Key
CVE-2026-27839		 CWE-639 Low
Available
No
 - 27.02.2026 SB2026022744
#VU123335 - Authorization Bypass Through User-Controlled Key
CVE-2026-27835		 CWE-639 Low
Available
No
 - 27.02.2026 SB2026022744
#VU93706 - Improper Restriction of Excessive Authentication Attempts
CVE-2022-2650		 CWE-307 High
No
No
 2.2 03.07.2024 SB2024070305
SB2024070313