LOW3.1PyPI
GHSA-42cr-w2gr-m54q· CVE-2026-27838, PYSEC-2026-3418wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data
Modified: 7/13/2026
package
PyPI/wger
pkg:pypi/wger
MEDIUM5.4PyPI
GHSA-6f54-qjvm-wwq3· CVE-2026-40353, PYSEC-2026-3419wger has Stored XSS via Unescaped License Attribution Fields
Modified: 7/13/2026
MEDIUM5.4PyPI
GHSA-8m9p-3926-gffr· CVE-2023-38758, PYSEC-2023-143wger Workout Manager Cross-site Scripting vulnerability
Modified: 11/19/2024
HIGH8.1PyPI
GHSA-9qpr-vc49-hqg2· CVE-2026-43978, PYSEC-2026-3420wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager
Modified: 7/13/2026
HIGH7.5PyPI
GHSA-cj9g-27ph-4cgv· CVE-2026-43977, PYSEC-2026-3421wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API
Modified: 7/13/2026
MEDIUM4.3PyPI
GHSA-g8gc-6c4h-jg86· CVE-2026-27839, PYSEC-2026-3422wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup
Modified: 7/13/2026
CRITICAL9.8PyPI
GHSA-gr58-76rp-mmg4· CVE-2022-2650, PYSEC-2026-573wger vulnerable to brute force attempts
Modified: 6/29/2026
CRITICAL9.9PyPI
GHSA-mhc8-p3jx-84mm· CVE-2026-43948, PYSEC-2026-574wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
Modified: 6/29/2026
HIGH8.5PyPI
GHSA-mw8f-w6p8-xrf4wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None
Modified: 5/20/2026
MEDIUM6.5PyPI
GHSA-v25j-wqcw-fvhj· CVE-2026-86255wger has an Uncontrolled Resource Consumption issue
Modified: 9/10/2026
MEDIUM5.4PyPI
GHSA-vqv8-j3mj-wjxj· CVE-2026-86256wger: trainer_login open redirect - ?next= parameter not validated against host
Modified: 9/10/2026
HIGH8.8PyPI
GHSA-wrw3-qmqw-4x9w· CVE-2023-38759, PYSEC-2023-144wger Workout Manager Cross-Site Request Forgery vulnerability
Modified: 11/19/2024
MEDIUM4.3PyPI
GHSA-xf68-8hjw-7mpm· CVE-2026-27835, PYSEC-2026-3423wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data
Modified: 7/13/2026
HIGH7.6PyPI
GHSA-xppv-4jrx-qf8m· CVE-2026-40474, PYSEC-2026-3424wger has Broken Access Control in Global Gym Configuration Update Endpoint
Modified: 7/13/2026
HIGH7.4PyPI
GHSA-xq9m-hmp9-fw87· CVE-2026-86257wger: CSV/TSV formula injection in gym member export (first_name/last_name)
Modified: 9/10/2026
MEDIUM5.4PyPI
PYSEC-2023-143· CVE-2023-38758, GHSA-8m9p-3926-gffrModified: 6/10/2026
HIGH8.8PyPI
PYSEC-2023-144· CVE-2023-38759, GHSA-wrw3-qmqw-4x9wModified: 6/10/2026
LOW3.1PyPI
PYSEC-2026-3418· CVE-2026-27838, GHSA-42cr-w2gr-m54qwger: IDOR via user-unscoped cache keys on routine API actions exposes workout data
Modified: 7/13/2026
MEDIUM5.4PyPI
PYSEC-2026-3419· CVE-2026-40353, GHSA-6f54-qjvm-wwq3wger has Stored XSS via Unescaped License Attribution Fields
Modified: 7/13/2026
HIGH8.1PyPI
PYSEC-2026-3420· CVE-2026-43978, GHSA-9qpr-vc49-hqg2wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager
Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-3421· CVE-2026-43977, GHSA-cj9g-27ph-4cgvwger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API
Modified: 7/13/2026
MEDIUM4.3PyPI
PYSEC-2026-3422· CVE-2026-27839, GHSA-g8gc-6c4h-jg86wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup
Modified: 7/13/2026
MEDIUM4.3PyPI
PYSEC-2026-3423· CVE-2026-27835, GHSA-xf68-8hjw-7mpmwger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data
Modified: 7/13/2026
HIGH7.6PyPI
PYSEC-2026-3424· CVE-2026-40474, GHSA-xppv-4jrx-qf8mwger has Broken Access Control in Global Gym Configuration Update Endpoint
Modified: 7/13/2026
CRITICAL9.8PyPI
PYSEC-2026-573· CVE-2022-2650, GHSA-gr58-76rp-mmg4wger vulnerable to brute force attempts
Modified: 7/1/2026
CRITICAL9.9PyPI
PYSEC-2026-574· CVE-2026-43948, GHSA-mhc8-p3jx-84mmwger: cross-tenant password reset and plaintext disclosure via gym=None bypass
Modified: 7/13/2026