pterodactyl panel

• CVE-2026-86177 High 8.8 Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks 0.6%
• CVE-2026-61609 High 7.5 Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS) 0.5%
• CVE-2026-54593 High 8.1 Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions 0.7%
• CVE-2026-35202 Low 2.3 Pterodactyl has a database resource limit bypass via race condition in Client API 0.2%
• CVE-2026-26016 Critical 9.2 Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization 0.4%
• CVE-2025-69199 High 8.3 Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances 0.3%
• CVE-2025-69198 Medium 6.0 Pterodactyl's improper resource locking allows raced queries to create more resources than alloted 0.2%
• CVE-2025-69197 Medium 6.5 Pterodactyl TOTPs can be reused during validity window 0.4%
• CVE-2025-68954 High 7.5 Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced 0.2%
• CVE-2025-49132 Critical 10.0 Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution 54.5%
• CVE-2024-49762 Medium 4.6 Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled 0.1%
• CVE-2024-34067 Medium 6.1 Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel 0.5%
• CVE-2021-41273 Medium 4.3 Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys 0.4%
• CVE-2021-41176 Medium 4.3 logout CSRF in Pterodactyl Panel 0.5%
• CVE-2021-41129 High 8.1 Authentication bypass in Pterodactyl 1.8%