pterodactyl

Records28All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high12CVSS 7.0–8.9

Exploited now

pterodactyl records in CISA KEV

No pterodactyl vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Wings 10 records HIGH Panel 9 records MEDIUM

Records

9 records in Panel · all components

TI-2026-21030 CVE-2026-26016 · GHSA-g7vw-f8p5-c728

Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization

MEDIUM 42

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0036 Published 2026-02-19 Fixed in 1.12.1 CWE-283

TI-2021-17968 CVE-2021-41129 · GHSA-5vfx-8w6m-h3v4

Authentication bypass in Pterodactyl

LOW 39

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01752 Published 2021-10-06 Fixed in 1.6.2 CWE-502

TI-2019-16080 CVE-2019-1020002 · GHSA-fg52-xjfc-9rh8

Pterodactyl before 0.7.14 with 2FA allows credential sniffing.

LOW 36

Pterodactyl before 0.7.14 with 2FA allows credential sniffing.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01475 Published 2019-07-29 Fixed in 0.7.14 CWE-203

TI-2025-42410 CVE-2025-68954 · GHSA-8c39-xppg-479c

Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced

LOW 34

Pterodactyl is a free, open-source game server management panel.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00242 Published 2026-01-06 Fixed in 1.12.0 CWE-613

TI-2025-42651 CVE-2025-69197 · GHSA-rgmp-4873-r683

Pterodactyl TOTPs can be reused during validity window

LOW 29

Pterodactyl is a free, open-source game server management panel.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00356 Published 2026-01-06 Fixed in 1.12.0 CWE-287

TI-2024-22525 CVE-2024-34067 · GHSA-384w-wffr-x63q

Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel

LOW 28

Pterodactyl is a free, open-source game server management panel built with PHP, React, and Go.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00457 Published 2024-05-03 Fixed in 1.11.6 CWE-79

TI-2025-42652 CVE-2025-69198 · GHSA-jw2v-cq5x-q68g

Pterodactyl's improper resource locking allows raced queries to create more resources than alloted

LOW 26

Pterodactyl is a free, open-source game server management panel.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00247 Published 2026-01-19 Fixed in 1.12.0 CWE-400

TI-2021-18015 CVE-2021-41176 · GHSA-m49f-hcxp-6hm6

logout CSRF in Pterodactyl Panel

LOW 21

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.0052 Published 2021-10-25 Fixed in 1.6.3 CWE-352

TI-2021-18105 CVE-2021-41273 · GHSA-wwgq-9jhf-qgw6

Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys

LOW 20

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00391 Published 2021-11-17 Fixed in 1.6.6 CWE-352

Open these records in search →