Wheels vulnerabilities

Products

• Wheels 9
• Cli 2

Newest

• wheels cli Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and... CVE-2026-111451 7.8 HighOctober 16, 2026
• wheels Wheels through 4.1.1 derives its default production error-email address from the Host header of... CVE-2026-111450 5.9 MediumOctober 16, 2026
• wheels Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true ... CVE-2026-111449 5.9 MediumOctober 16, 2026
• wheels Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case... CVE-2026-111448 3.7 LowOctober 16, 2026
• wheels Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without... CVE-2026-111447 8.1 HighOctober 16, 2026
• wheels Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote... CVE-2026-111446 8.6 HighOctober 16, 2026
• wheels Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key... CVE-2026-111445 8.1 HighOctober 16, 2026
• wheels Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled ... CVE-2026-111444 Public exploit 9.8 CriticalOctober 16, 2026
• wheels Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test... CVE-2026-111443 6.5 MediumOctober 16, 2026
• wheels Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed... CVE-2026-110911 9.8 CriticalOctober 15, 2026
• wheels cli Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP... CVE-2026-110909 5.0 MediumOctober 15, 2026