CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 31/07/2026 |
| CVE-2026-54593 | HIGH8.1 | Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without checking the token's intended purpose; because the Panel issues | 28/07/2026 |
| GO-2026-5814 | Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container in github.com/pterodactyl/wings | 07/07/2026 |
| GHSA-rhq6-9rgh-v45c | MEDIUM5.0 | Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container | 26/06/2026 |
| GO-2026-4497 | Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings | 23/02/2026 |
| GHSA-hr7j-63v7-vj7g | HIGH | Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change | 17/02/2026 |
| CVE-2026-21696 | MEDIUM6.5 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Wings does not consider SQLite max parameter limit when processing activity log entries allowing for low privileged user to trigger a condition that floods the pane | 19/01/2026 |
| CVE-2025-69199 | MEDIUM6.5 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings lack proper rate limiting and throttling. As a result a malicious user can open a large number of connections and then request data through these sockets, causing an exce | 19/01/2026 |
| CVE-2025-68954 | MEDIUM5.4 | Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connecte | 06/01/2026 |
| GO-2022-0389 | Unchecked hostname resolution could allow access to local network resources by users outside the local network in github.com/pterodactyl/wings | 21/08/2024 |
| CVE-2024-34068 | MEDIUM6.4 | Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously implemented access control (GHSA-6rg3-8h8x-5xfv) that prevents accessing internal endpoints of the node hosting Wings in the pull endpoint. This would allow malicio | 03/05/2024 |
| CVE-2024-34066 | HIGH8.4 | Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to. This issue has been addressed in ve | 03/05/2024 |
| CVE-2024-27102 | HIGH8.5 | Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potentially be used to access files and directories on the host system. The full scope of impact is exactly unknown, but reading files outside of a server's base direc | 13/03/2024 |
| CVE-2023-32080 | HIGH8.8 | Wings is the server control plane for Pterodactyl Panel. A vulnerability affecting versions prior to 1.7.5 and versions 1.11.0 prior to 1.11.6 impacts anyone running the affected versions of Wings. This vulnerability can be used to gain access to the host system running Wings if a user is able to modify an server's in | 10/05/2023 |
| CVE-2023-25168 | HIGH8.2 | Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with `GHSA-p8r3-83r8-jwj5` to overwrite files on the host system. In order to use this exploit, an attacker must have an existing "server" alloc | 09/02/2023 |
| CVE-2023-25152 | HIGH8.8 | Wings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and directory structures on the host system that previously did not exist, potentially allowing attackers to change their resource allocations, promote their containers to privileged mode, | 08/02/2023 |
| GHSA-6rg3-8h8x-5xfv | MEDIUM6.4 | Unchecked hostname resolution could allow access to local network resources by users outside the local network | 23/06/2021 |
| CVE-2021-32699 | MEDIUM6.5 | Wings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.4` are vulnerable to system resource exhaustion due to improper container process limits being defined. A malicious user can consume more resources than intended and cause downstre | 22/06/2021 |