Stars and mentions
Last 30 days, Oct 5 – Nov 3
Package downloads
Top repositories
wger-project’s repositories ranked by new stars, as on trending.
Contributes to
Repositories outside wger-project’s account where wger-project opened or reviewed pull requests in the past 365 days.
Who noticed wger-project
Everyone who starred or forked wger-project’s repositories since the archive began in 2011.
Notable accounts
Ordered by the stars their own repositories have received.
Biggest fans
Accounts that starred the most of these repositories.
Breakout weeks
Each repository’s best week of new stars, with the release published around it.
Achievements
Awards earned by the repositories wger-project owns. Select an award to embed its badge.
No awards yet
Repositories earn awards by reaching the top three in a completed trending day or week.
A repository earns an award for finishing first, second or third in a completed trending day or week, ranked by new stars, new forks or pull request authors. Awards follow a repository through renames and transfers and count toward its current owner. Weeks run Monday to Sunday, UTC.
Mentions
Workout plans lost in notes and spreadsheets? 🏋️ wger helps track routines, body weight and nutrition, with a self-hosted option. Keep it all together. 📊 wger-project/wger #Fitness #浇朋友 #蓝朋友 #互关 #fo
健身计划写在备忘录里，记录起来太乱？🏋️ wger 能管理训练动作、计划、体重和饮食记录，还支持自托管。📊 wger-project/wger #Fitness #浇朋友 #蓝朋友 #互关 #fo
CVE-2026-46438: CVE-2026-46438: Broken Object Level Authorization in wger Workout Log Endpoint CVE-2026-46438: Broken Object Level Authorization in wger Workout Log Endpoint > Vulnerability ID: CVE-2026-46438 > CVSS Score: 6.5 > Published: 2026-10-07 CVE-2026-46438 is a critical Broken Object Level Authorization (BOLA) / Insecure Direct Object Reference (IDOR) vulnerability identified in the wger fitness manager prior to version 2.6. An authenticated attacker can exploit a missing authorization check on the slot_entry API parameter to inject unauthorized workout logs into another user's training schedule. This results in the corruption of the target user's automated progressive-overload calculations. TL;DR Missing validation in wger's API endpoints allows authenticated users to inject unauthorized training logs into any user's workout schedule by referencing their slot_entry ID, corrupting dynamic progressive-overload configurations. --- ⚠️ Exploit Status: POC Technical Details - CWE ID: CWE-862 (Missing Authorization) - Attack Vector: Network - CVSS v3.1: 6.5 (Medium) - Exploit Status: Proof of Concept (PoC) available - Remediation: Official upgrade path to version 2.6 Affected Systems - wger-project/wger - wger: < 2.6 (Fixed in: 2.6) Code Analysis Commit: b29cf17 Fix ownership checks for workout logs and slot entries Mitigation Strategies - Restrict user ownership configurations on all related sub-objects at both the controller layer and model validation layer. - Isolate internal query relationships in calculation engines by strictly scoping lookups to the routine's owner user. Remediation Steps: 1. Upgrade the wger environment to version 2.6 or later. 2. Audit active databases for existing cross-user references within the WorkoutLog tables and prune inconsistent records. 3. Enable monitoring for HTTP 403 Forbidden responses on the workout log REST API endpoints. References - GitHub Security Advisory GHSA-rjpf-7pf5-q54x - Patch Commit b29cf178651bbcc243d21673932e32bd42017893 --- Read the full report for CVE-2026-46438 on our website for more details including interactive diagrams and full exploit analysis.
爱身子的朋友们，这两款开源健身神器到底该怎么选？🤔🔥 🏋️ openGym（4.1k★）： 专注力量训练，递进规则、肌肉恢复图、RIR/RPE，一条 docker 命令跑起来，通行密钥登录 ⏬ DuarteSantos8/openGym 🥗 wger（6.9k★）： 训练+饮食热量+体重+进度照，商店有官方 App，还能做多用户的 ⏬ wger-project/wger 练得细选前者，管得全选后者。你用哪个？🤔