panel
- Software type
- Other
- Total vulnerabilities (90 days)
- 1
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
CyStack could not complete this security profile. The original vulnerability records remain available below.
As of 11/08/2026, panel recorded 1 security vulnerability in the last 90 days, of which 1 is rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of panel and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-86177Pterodactyl Panel missing scheduled-task authorization enables subuser privilege escalationCVE-2026-61609Global authentication rate limiter enables login denial of service in Pterodactyl PanelCVE-2026-54593Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissionsCVE-2026-35202Pterodactyl has a database resource limit bypass via race condition in Client APICVE-2026-26016Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-86177Pterodactyl Panel missing scheduled-task authorization enables subuser privilege escalation | Exploitation statusActively exploited | FixYes |
| SeverityHigh |
CVE-2026-61609Global authentication rate limiter enables login denial of service in Pterodactyl Panel | Exploitation statusActively exploited | FixYes | Published07/28/2026 | SeverityHigh |
|---|
CVE-2026-54593Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions | Exploitation statusActively exploited | FixYes | Published07/28/2026 | SeverityHigh |
|---|
CVE-2026-35202Pterodactyl has a database resource limit bypass via race condition in Client API | Exploitation statusNot exploited | FixNo | Published06/02/2026 | SeverityLow |
|---|
CVE-2026-26016Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization | Exploitation statusNot exploited | FixNo | Published02/19/2026 | SeverityCritical |
|---|
CVE-2025-69199Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances | Exploitation statusNot exploited | FixNo | Published01/19/2026 | SeverityHigh |
|---|
CVE-2025-69198Pterodactyl's improper resource locking allows raced queries to create more resources than alloted | Exploitation statusNot exploited | FixNo | Published01/19/2026 | SeverityMedium |
|---|
CVE-2025-69197Pterodactyl TOTPs can be reused during validity window | Exploitation statusNot exploited | FixYes | Published01/06/2026 | SeverityMedium |
|---|
CVE-2025-68954Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced | Exploitation statusNot exploited | FixYes | Published01/06/2026 | SeverityHigh |
|---|
CVE-2025-49132Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution | Exploitation statusNot exploited | FixYes | Published06/20/2025 | SeverityCritical |
|---|
CVE-2024-49762Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled | Exploitation statusNot exploited | FixYes | Published10/24/2024 | SeverityMedium |
|---|
CVE-2024-34067Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel | Exploitation statusNot exploited | FixNo | Published05/03/2024 | SeverityMedium |
|---|
CVE-2021-41273Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys | Exploitation statusNot confirmed | FixNo | Published11/17/2021 | SeverityMedium |
|---|
CVE-2021-41176logout CSRF in Pterodactyl Panel | Exploitation statusNot confirmed | FixYes | Published10/25/2021 | SeverityMedium |
|---|
CVE-2021-41129Authentication bypass in Pterodactyl | Exploitation statusNot confirmed | FixNo | Published10/06/2021 | SeverityHigh |
|---|
15 Results | Page 1 of 1