[ Vendor · 11 CVEs ]
Wheels
CVEs affecting Wheels published in the last 30 days, plus any Wheels CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111448 | 16 Oct 2026 | CVSS 3.7 | WheelsWheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip… | |
| CVE-2026-111449 | 16 Oct 2026 | CVSS 5.9 | WheelsWheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request… | |
| CVE-2026-111450 | 16 Oct 2026 | CVSS 5.9 | WheelsWheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no… | |
| CVE-2026-111451 | 16 Oct 2026 | CVSS 7.8 | Wheels CLIWheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback… | |
| CVE-2026-111443 | 16 Oct 2026 | CVSS 6.5 | WheelsWheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by… | |
| CVE-2026-111444 | 16 Oct 2026 | CVSS 9.8 | WheelsWheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies… | |
| CVE-2026-111445 | 16 Oct 2026 | CVSS 8.1 | WheelsWheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For… | |
| CVE-2026-111446 | 16 Oct 2026 | CVSS 8.6 | WheelsWheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by… | |
| CVE-2026-111447 | 16 Oct 2026 | CVSS 8.1 | WheelsWheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A… | |
| CVE-2026-110911 | 15 Oct 2026 | CVSS 9.8 | WheelsWheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as… | |
| CVE-2026-110909 | 15 Oct 2026 | CVSS 5.0 | Wheels CLIWheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process… |