WH
Vendor
Wheels
11
CVEs
0
On KEV
11
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111451 | WC Wheels CLI Wheels | 7.8 | Oct 16 | Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents |
| CVE-2026-111450 | WH Wheels Wheels | 5.9 | Oct 16 | Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application |
| CVE-2026-111449 | WH Wheels Wheels | 5.9 | Oct 16 | Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default) |
| CVE-2026-111448 | WH Wheels Wheels | 3.7 | Oct 16 | Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems |
| CVE-2026-111447 | WH Wheels Wheels | 8.1 | Oct 16 | Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved |
| CVE-2026-111446 | WH Wheels Wheels | 8.6 | Oct 16 | Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development |
| CVE-2026-111445 | WH Wheels Wheels | 8.1 | Oct 16 | Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=) |
| CVE-2026-111444 | WH Wheels Wheels | 9.8 | Oct 16 | Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to… |
| CVE-2026-111443 | WH Wheels Wheels | 6.5 | Oct 16 | Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context… |
| CVE-2026-110911 | WH Wheels Wheels | 9.8 | Oct 15 | Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's… |
| CVE-2026-110909 | WC Wheels CLI Wheels | 5.0 | Oct 15 | Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project |