Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,241All CVEsplus 19,125 rejected
- 477Last 24 hours2,761 in the last 7 days
- 16,906Last 30 days1,544 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 4 | 4 | 1 | 0 | 11 | 11 |
| Title | ||
|---|---|---|
| CVE-2026-111451 | Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can…Wheels · Wheels CLI | High7.8 |
| CVE-2026-111450 | Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit…Wheels · Wheels | Medium5.9 |
| CVE-2026-111449 | Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes…Wheels · Wheels | Medium5.9 |
| CVE-2026-111448 | Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries,…Wheels · Wheels | Low3.7 |
| CVE-2026-111447 | Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to…Wheels · Wheels | High8.1 |
| CVE-2026-111446 | Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in…Wheels · Wheels | High8.6 |
| CVE-2026-111445 | Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=),…Wheels · Wheels | High8.1 |
| CVE-2026-111444 | Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request…Wheels · Wheels | Critical9.8 |
| CVE-2026-111443 | Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an…Wheels · Wheels | Medium6.5 |
| CVE-2026-110911 | Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the…Wheels · Wheels | Critical9.8 |
| CVE-2026-110909 | Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a…Wheels · Wheels CLI | Medium5.0 |