Wheels vulnerabilities

Newest CVEs

• CVE-2026-111451

  Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can…

  Wheels · Wheels CLI

  High7.8
• CVE-2026-111450

  Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit…

  Wheels · Wheels

  Medium5.9
• CVE-2026-111449

  Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes…

  Wheels · Wheels

  Medium5.9
• CVE-2026-111448

  Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries,…

  Wheels · Wheels

  Low3.7
• CVE-2026-111447

  Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to…

  Wheels · Wheels

  High8.1
• CVE-2026-111446

  Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in…

  Wheels · Wheels

  High8.6
• CVE-2026-111445

  Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=),…

  Wheels · Wheels

  High8.1
• CVE-2026-111444

  Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request…

  Wheels · Wheels

  Critical9.8
• CVE-2026-111443

  Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an…

  Wheels · Wheels

  Medium6.5
• CVE-2026-110911

  Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the…

  Wheels · Wheels

  Critical9.8