High
CVE-2026-54593
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 19
Reset filters
High
CVE-2026-61609
Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)
Medium
ghsa-j7f5-gfqm-pcx3
Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system
Low
CVE-2026-35202
Pterodactyl has a database resource limit bypass via race condition in Client API
Critical
CVE-2026-26016
Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization
High
ghsa-hr7j-63v7-vj7g
Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change
Medium
CVE-2025-69198
Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted
Medium
CVE-2025-69197
Pterodactyl TOTPs can be reused during validity window
High
CVE-2025-68954
Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
Low
ghsa-mgr9-6c2j-jxrq
Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host”
Critical
CVE-2025-49132
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
Medium
CVE-2024-49762
Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled
Medium
CVE-2024-34067
Pterodactyl panel's admin area vulnerable to Cross-site Scripting
High
CVE-2019-1020002
Pterodactyl vulnerable to 2FA Sniffing
Medium
ghsa-7v3x-h7r2-34jv
Insufficient Session Expiration in Pterodactyl API
Medium
CVE-2021-41273
Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys
Low
CVE-2021-41176
pterodactyl/panel CSRF allowing an external page to trigger a user logout event
High
CVE-2021-41129
Pterodactyl Panel vulnerable to authentication bypass due to improper user-provided security token verification
Medium
ghsa-5822-pw57-vv37
XSS vulnerability when listing users on add & modify server pages.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.