Security
فارسی
All products

pterodactyl/panel

Composer · Package
19 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in systemGHSA-J7F5-GFQM-PCX3 pterodactyl/panel Composer Medium Fix reported
Pterodactyl has a database resource limit bypass via race condition in Client APICVE-2026-35202 · GHSA-FGMM-W5CX-VRFW pterodactyl/panel Composer Low Fix reported
Pterodactyl panel's admin area vulnerable to Cross-site ScriptingCVE-2024-34067 · GHSA-384W-WFFR-X63Q pterodactyl/panel Composer Medium Fix reported
Pterodactyl vulnerable to 2FA SniffingCVE-2019-1020002 · GHSA-FG52-XJFC-9RH8 pterodactyl/panel Composer High Fix reported
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissionsCVE-2026-54593 · GHSA-8R6W-3QQ5-4P4RVersion ranges need review. pterodactyl/panelgithub.com/pterodactyl/wings ComposerGo High Fix reported
Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)CVE-2026-61609 · GHSA-XVC3-826V-XF47 pterodactyl/panel Composer High Fix reported
Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keysCVE-2021-41273 · GHSA-WWGQ-9JHF-QGW6 pterodactyl/panel Composer Medium Fix reported
Pterodactyl Panel vulnerable to authentication bypass due to improper user-provided security token verificationCVE-2021-41129 · GHSA-5VFX-8W6M-H3V4 pterodactyl/panel Composer High Fix reported
pterodactyl/panel CSRF allowing an external page to trigger a user logout eventCVE-2021-41176 · GHSA-M49F-HCXP-6HM6 pterodactyl/panel Composer Low Fix reported
Pterodactyl improperly locks resources allowing raced queries to create more resources than allotedCVE-2025-69198 · GHSA-JW2V-CQ5X-Q68G pterodactyl/panel Composer Medium Fix reported
Pterodactyl does not revoke SFTP access when server is deleted or permissions reducedCVE-2025-68954 · GHSA-8C39-XPPG-479CVersion ranges need review. pterodactyl/panelgithub.com/pterodactyl/wings ComposerGo High Fix reported
Pterodactyl Panel's SFTP sessions remain active after user account deletion or password changeGHSA-HR7J-63V7-VJ7G · GO-2026-4497Version ranges need review. pterodactyl/panelgithub.com/pterodactyl/wings ComposerGo High Fix reported
Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing AuthorizationCVE-2026-26016 · GHSA-G7VW-F8P5-C728 pterodactyl/panel Composer Critical Fix reported
Pterodactyl TOTPs can be reused during validity windowCVE-2025-69197 · GHSA-RGMP-4873-R683 pterodactyl/panel Composer Medium Fix reported
Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host”GHSA-MGR9-6C2J-JXRQ pterodactyl/panel Composer Low Fix reported
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code ExecutionCVE-2025-49132 · GHSA-24WV-6C99-F843 pterodactyl/panel Composer Critical Fix reported
Insufficient Session Expiration in Pterodactyl APIGHSA-7V3X-H7R2-34JV pterodactyl/panel Composer Medium Fix reported
XSS vulnerability when listing users on add & modify server pages.GHSA-5822-PW57-VV37 pterodactyl/panel Composer Medium Fix reported
Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabledCVE-2024-49762 · GHSA-C479-WQ8G-57HR pterodactyl/panel Composer Medium Fix reported