These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-111451 debrief based on the supplied source corpus. The CVE record was published on 2026-10-16T04:18:31.667Z and has not been modified since then. Affected product deployments exist in managed environments and require verification. The vulnerability class involves insufficient validation or escaping of caller-supplied values and package contents in Wheels CLI versions 4.0.0 through 4.1.1, potenti [truncated]
CVE-2026-111450 is a vulnerability in Wheels 4.1.1 that allows an attacker to direct error emails to an address under their control if no explicit error-email recipient is configured and the server accepts an attacker-chosen Host header. This can lead to disclosure of error and request metadata, and potentially configuration secrets and other users' session/cookie data on certain engines/versions.
CVE-2026-111449 debrief based on the supplied source corpus. The vulnerability affects Wheels 3.0.0 through 4.1.1, allowing disclosure of detailed exceptions when allowIPBasedDebugAccess=true. This can lead to potential unauthorized access to sensitive information. Developers and administrators should assess exposure, adjust settings, or update to a fixed version to prevent potential unauthorized access t [truncated]
CVE-2026-111448 is a vulnerability in Wheels 4.0.0 through 4.1.2 that allows access outside the intended root, including limited file disclosure, due to case-insensitive comparisons in path-containment checks on case-sensitive filesystems. The vulnerability affects Wheels installations, particularly those exposed to untrusted inputs. Defenders should assess the potential for limited file disclosure and pr [truncated]
CVE-2026-111447 is a high-severity vulnerability in Wheels 1.1 through 4.1.2 that allows users to update, reassign, or delete another parent's hasMany or hasOne rows by submitting a nested form. This issue is due to inadequate validation in the resolve_nestedProperties() function, which fails to verify if records belong to the parent being saved. The vulnerability can lead to unauthorized data modificatio [truncated]
CVE-2026-111446 debrief based on the supplied source corpus. The vulnerability in Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, allowing access to application settings, environment/datasource details and routes, and starting test runs. This issue is fixed in version 4.2.0. Defenders should assess exposure and take reme [truncated]
CVE-2026-111445 is a high-severity vulnerability in the Wheels framework, affecting versions 4.0.0 through 4.1.2 before 4.2.0. The vulnerability allows an attacker to bypass scope conditions in certain methods, potentially leading to unauthorized data access or modification. This occurs because incoming scope conditions are replaced with a primary-key condition in findByKey() and exists(key=). For exists( [truncated]
A SQL injection vulnerability exists in Wheels 4.1.2 when using MySQL/MariaDB with backslash escaping enabled. This allows an attacker to alter query behavior by doubling single quotes without accounting for backslash escapes, affecting opt-in parameterize=false queries and certain developer-written where strings. The vulnerability can lead to unauthorized data access or modification, and defenders should [truncated]
CVE-2026-111443 is a vulnerability in Wheels 4.0.6 through 4.1.2 that allows an unauthenticated client to switch a request into a separate test application context. This issue is fixed in version 4.2.0. The vulnerability can bypass maintenance mode enabled only at runtime, provide a second set of in-memory rate-limit counters, and trigger additional application-startup side effects and memory use. Affecte [truncated]