https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-21696.htmlhttps://patchthecve.com/cve/CVE-2026-21696.htmlWed, 17 Jun 2026 10:18:56 +0000MEDIUM 6.5: Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Wings does not consider SQLite max parameter limit when processing activity log entries allowing for low privileged user to trigger a condition https://patchthecve.com/cve/CVE-2025-69199.htmlhttps://patchthecve.com/cve/CVE-2025-69199.htmlWed, 17 Jun 2026 10:00:16 +0000MEDIUM 6.5: Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings lack proper rate limiting and throttling. As a result a malicious user can open a large number of connections and then request data through these sockhttps://patchthecve.com/cve/CVE-2025-68954.htmlhttps://patchthecve.com/cve/CVE-2025-68954.htmlWed, 07 Oct 2026 10:10:00 +0000MEDIUM 5.4: Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFThttps://patchthecve.com/cve/CVE-2024-34068.htmlhttps://patchthecve.com/cve/CVE-2024-34068.htmlWed, 17 Jun 2026 07:32:50 +0000MEDIUM 6.4: Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously implemented access control (GHSA-6rg3-8h8x-5xfv) that prevents accessing internal endpoints of the node hosting Wings in the pull endpoint. Thishttps://patchthecve.com/cve/CVE-2024-34066.htmlhttps://patchthecve.com/cve/CVE-2024-34066.htmlWed, 17 Jun 2026 07:32:50 +0000HIGH 8.4: Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to. This issue has