W
Vendor security profile
wger-project
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs7
Critical0
CISA KEV0
Public exploit4
Patch rate%14
Avg. CVSS6.2
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
1
1
5
CVE KEV
CVE severity distribution
7toplam CVE
High3 (43%)
Medium4 (57%)
Patch and exploitation view
%14
Verified patch
%0
CISA KEV
%57
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
6Unknown
Latest vulnerabilities
6.5
CVE-2026-46438
wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry
W
Patch status unknownEPSS %0
4.8
CVE-2026-46437
wger: API credentials remain valid after logout/password change
W
Patch status unknownEPSS %0
7.1
CVE-2026-46434
wger: Trainer Privilege Escalation - Improper Privilege Management
W
Patch status unknownEPSS %0
5.4
CVE-2026-45161
wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
W
Patch status unknownEPSS %0
7.1
CVE-2026-43976
wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
W
Patch status unknownEPSS %0
7.1
CVE-2026-86255
wger before 2.5 Uncontrolled Resource Consumption via date_sequence
W
Patch status unknownEPSS %0
5.3
CVE-2026-82544
wger-project wger Password Reset gym.py reset_user_password cross-site request forgery
W
Patch verifiedEPSS %0