Wheels has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 7.4 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.4
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
2
Total CVEs
1
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-110911Critical· 9.8Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), stri…54CVE-2026-110909Medium· 5.0Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project28
Wheels vulnerabilities
CVEs affecting Wheels, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-110911Critical· 9.8Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), stri…
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), stri…
▾ MidnightWheels · Wheelsvia NVD
CVE-2026-110909Medium· 5.0Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project
Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code s…
▾ SunlitWheels · Wheels CLIvia NVD