165089 matches found
GHSA-X249-CX55-2H87 wger: Trainer Privilege Escalation - Improper Privilege Management
Summary A user with only the gymtrainer permission can deactivate any account in the same gym, including gymmanager and generalgymmanager accounts. The UserDeactivateView grants access to anyone holding any one of gym.managegym, gym.managegyms, or gym.gymtrainer OR logic via...
wger: API credentials remain valid after logout/password change
Summary A vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue ...
GHSA-V3X9-6GG8-C2C9 wger: API credentials remain valid after logout/password change
Summary A vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue ...
GHSA-C72H-82W6-RQFP wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
Summary Five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment gym=None can read private admin notes, uploaded documents, gym contracts...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via a flawed gym-scope guard in five gym management views wger/gym/views/adminnotes.py, wger/gym/views/document.py, wger/gym/views/contract.py, wger/gym/views/userconfig.py, and wger/gym/views/user.py that compar...
wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
Summary Five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment gym=None can read private admin notes, uploaded documents, gym contracts...
CVE-2026-43976 wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment...
EUVD-2026-94328
wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment...
CVE-2026-43976 wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment...
CVE-2026-43976
wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard "gyma != gymb" that silently passes when both operands are "None". A trainer with "gym.gymtrainer" and "gym.addadminusernote" permissions and no gym...
CVE-2026-43976 wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment...
CVE-2026-43976
The wger fitness manager is vulnerable to a cross-tenant data leak in versions prior to 2.6 . A flaw in the gym-scope guard (gym_a != gym_b) allows it to silently pass when both operands are None. Consequently, a trainer with gym.gym_trainer and gym.add_adminusernote permissions but no gym assign...
FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
The U.S. Federal Bureau of Investigation FBI and Secret Service USSS on Tuesday warned that the FortiBleed credential harvesting campaign remains an active threat aimed at internet-facing Fortinet FortiGate firewalls and secure socket layer SSL virtual private network VPN gateways. "The campaign...
Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.
Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-42580 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflow...
LSN-0122-1: Kernel Live Patch Security Notice
In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix use after free in midcomms commit While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning: . In the Linux kernel, the following vulnerability has been...
LSN-0122-1 Kernel Live Patch Security Notice
In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix use after free in midcomms commit While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning: . In the Linux kernel, the following vulnerability has been...
Security Bulletin: InfoSphere Data Architect (IDA) 9.2.2 Vulnerability Fixes
Summary Security Bulletin: Multiple vulnerabilities getting fixed with InfoSphere Data Architect IDA 9.2.2. Hence, IBM strongly recommends upgrading to v9.2.2 Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or...
CVE-2026-19186
ieee802154decipherdataframe in subsys/net/l2/ieee802154/ieee802154frame.c computed payloadlen = netpktgetlenpkt - llhdrlen - authtaglen without first checking that the received frame is at least llhdrlen + authtaglen bytes long. All three variables are uint8t, so a frame whose payload is shorter...
Exploit for CVE-2026-21589
CVE-2026-21589 — Atlassian Pre-Auth Arbitrary File Read → Crow...
CVE-2026-19186 Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write
ieee802154decipherdataframe in subsys/net/l2/ieee802154/ieee802154frame.c computed payloadlen = netpktgetlenpkt - llhdrlen - authtaglen without first checking that the received frame is at least llhdrlen + authtaglen bytes long. All three variables are uint8t, so a frame whose payload is shorter...