CVE-2026-111450

The Wheels framework (versions through 4.1.1 ) is vulnerable to an issue where it derives the default production error-email address from the Host header of the initial request starting the application. If an explicit recipient is not configured and a mail server is active, an attacker can trigge...