CVE-2026-52856 | High | 7.5 | 2026-07-31 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SF… |
CVE-2026-52855 | Critical | 9.9 | 2026-07-31 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configura… |
CVE-2026-52857 | Medium | 5.5 | 2026-07-31 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configurati… |
CVE-2026-61609 | High | 7.5 | 2026-07-28 | Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::conf… |
CVE-2026-54593 | High | 8.1 | 2026-07-28 | Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accept… |
CVE-2026-35202 | | | 2026-06-02 | Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass th… |
CVE-2026-26016 | High | 8.1 | 2026-02-19 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization check in… |
CVE-2026-21696 | Medium | 6.5 | 2026-01-19 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Win… |
CVE-2025-69199 | Medium | 6.5 | 2026-01-19 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings lack prop… |
CVE-2025-69198 | Medium | 6.5 | 2026-01-19 | Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources (e.g. dat… |
CVE-2025-69197 | Medium | 6.5 | 2026-01-06 | Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Us… |
CVE-2025-68954 | Medium | 5.4 | 2026-01-06 | Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a… |
CVE-2025-49132 | Critical | 10.0 | 2025-06-20 | Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query p… |
CVE-2024-49762 | Medium | 4.6 | 2024-10-24 | Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a `DELETE` request with their cu… |
CVE-2024-34068 | Medium | 6.4 | 2024-05-03 | Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously imp… |
CVE-2024-34067 | Medium | 6.1 | 2024-05-03 | Pterodactyl is a free, open-source game server management panel built with PHP, React, and Go. Importing a malicious egg or gaining access to wings instance co… |
CVE-2024-34066 | High | 8.4 | 2024-05-03 | Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accide… |
CVE-2024-27102 | Critical | 9.9 | 2024-03-13 | Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potent… |
CVE-2023-32080 | Critical | 9.0 | 2023-05-10 | Wings is the server control plane for Pterodactyl Panel. A vulnerability affecting versions prior to 1.7.5 and versions 1.11.0 prior to 1.11.6 impacts anyone r… |
CVE-2023-25168 | Critical | 9.6 | 2023-02-09 | Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability… |
CVE-2023-25152 | High | 8.4 | 2023-02-08 | Wings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and directory structures on… |
CVE-2021-41273 | Medium | 4.3 | 2021-11-17 | Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a mali… |
CVE-2021-41176 | Medium | 4.3 | 2021-10-25 | Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a… |
CVE-2021-41129 | High | 8.1 | 2021-10-06 | Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a `confirmation_token`… |
CVE-2021-32699 | Medium | 6.5 | 2021-06-22 | Wings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.4` are vulnerable t… |
CVE-2019-1020002 | High | 7.5 | 2019-07-29 | Pterodactyl before 0.7.14 with 2FA allows credential sniffing. |