Log in Start free

pterodactyl

Products

ProductCVEsExploitedLatest
panel15–Sep 5, 2026
wings12–Aug 26, 2026

Exploited and recent CVEs

  • CVE-2026-86177 High 8.8 Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks 0.6%
  • CVE-2026-61617 High 7.7 Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion 0.4%
  • CVE-2026-52856 High 7.5 Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service 0.6%
  • CVE-2026-52855 Critical 9.9 Wings exposes node configuration secrets through egg configuration-file templating 0.5%
  • CVE-2026-52857 Medium 5.5 Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM 0.2%
  • CVE-2026-61609 High 7.5 Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS) 0.5%
  • CVE-2026-54593 High 8.1 Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions 0.7%
  • CVE-2026-35202 Low 2.3 Pterodactyl has a database resource limit bypass via race condition in Client API 0.2%
  • CVE-2026-26016 Critical 9.2 Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization 0.4%
  • CVE-2026-21696 High 8.3 Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered 0.6%
  • CVE-2025-69199 High 8.3 Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances 0.3%
  • CVE-2025-69198 Medium 6.0 Pterodactyl's improper resource locking allows raced queries to create more resources than alloted 0.2%
  • CVE-2025-69197 Medium 6.5 Pterodactyl TOTPs can be reused during validity window 0.4%
  • CVE-2025-68954 High 7.5 Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced 0.2%
  • CVE-2025-49132 Critical 10.0 Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution 54.5%
  • CVE-2024-49762 Medium 4.6 Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled 0.1%
  • CVE-2024-34066 High 8.5 Arbitrary File Write/Read in Pterodactyl wings 0.5%
  • CVE-2024-34067 Medium 6.1 Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel 0.5%
  • CVE-2024-34068 Medium 6.4 Server-side Request Forgery during remote file pull in Pterodactyl wings 0.4%
  • CVE-2024-27102 Critical 10.0 Improper isolation of server file access in github.com/pterodactyl/wings 0.5%
  • CVE-2023-32080 Critical 9.1 Wings vulnerable to escape to host from installation container 0.9%
  • CVE-2023-25168 Critical 9.6 Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings 1.0%
  • CVE-2023-25152 High 8.4 Symbolic Link (Symlink) Following in github.com/pterodactyl/wings 0.7%
  • CVE-2021-41273 Medium 4.3 Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys 0.4%
  • CVE-2021-41176 Medium 4.3 logout CSRF in Pterodactyl Panel 0.5%
  • CVE-2021-41129 High 8.1 Authentication bypass in Pterodactyl 1.8%
  • CVE-2021-32699 Medium 6.5 Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings 0.3%