WH
Product
Wheels
9
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 2High 3Medium 3Low 1
Watch
Add Wheels to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-111443 | 6.5 | Oct 16 | Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context… Affected: 4.0.6 before 4.2.0 |
| CVE-2026-111450 | 5.9 | Oct 16 | Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application Affected: before 4.1.2 |
| CVE-2026-111449 | 5.9 | Oct 16 | Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default) Affected: 3.0.0 before 4.1.2 |
Showing 3