WH
Product
Wheels
9
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 2High 3Medium 3Low 1
Watch
Add Wheels to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-111446 | 8.6 | Oct 16 | Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development Affected: 4.0.0 before 4.2.0 |
| CVE-2026-111447 | 8.1 | Oct 16 | Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved Affected: 1.1.0 before 4.2.0 |
| CVE-2026-111445 | 8.1 | Oct 16 | Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=) Affected: 4.0.0 before 4.2.0 |
Showing 3