Reliance on Untrusted Inputs in a Security Decision

Overview Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through improper validation of DNSSEC responses and insufficient cache scoping. An attacker can inject and persist forged DNS records by providing unsigned or manipulated DNS answers...

Reliance on Untrusted Inputs in a Security Decision

Overview Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through improper validation of DNSSEC responses and insufficient cache scoping. An attacker can inject and persist forged DNS records by providing unsigned or manipulated DNS answers...

CVE-2026-27838

wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling "self.getobject". In versions up to and including 2.4, ache keys are scoped only by "pk" — no user ID is included. When a victim has previously accessed their routine via the...