https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-21696.htmlhttps://patchthecve.com/cve/CVE-2026-21696.htmlWed, 17 Jun 2026 10:18:56 +0000MEDIUM 6.5: Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Wings does not consider SQLite max parameter limit when processing activity log entries allowing for low privileged user to trigger a condition https://patchthecve.com/cve/CVE-2025-69199.htmlhttps://patchthecve.com/cve/CVE-2025-69199.htmlWed, 17 Jun 2026 10:00:16 +0000MEDIUM 6.5: Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings lack proper rate limiting and throttling. As a result a malicious user can open a large number of connections and then request data through these sockhttps://patchthecve.com/cve/CVE-2025-69198.htmlhttps://patchthecve.com/cve/CVE-2025-69198.htmlWed, 17 Jun 2026 10:00:16 +0000MEDIUM 6.5: Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources (e.g. databases, port allocations, or backups) that can exist for an individual server. These resource limits are applied on a per-server basis, and vhttps://patchthecve.com/cve/CVE-2025-69197.htmlhttps://patchthecve.com/cve/CVE-2025-69197.htmlWed, 07 Oct 2026 10:10:00 +0000MEDIUM 6.5: Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This alhttps://patchthecve.com/cve/CVE-2025-68954.htmlhttps://patchthecve.com/cve/CVE-2025-68954.htmlWed, 07 Oct 2026 10:10:00 +0000MEDIUM 5.4: Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFThttps://patchthecve.com/cve/CVE-2024-34068.htmlhttps://patchthecve.com/cve/CVE-2024-34068.htmlWed, 17 Jun 2026 07:32:50 +0000MEDIUM 6.4: Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously implemented access control (GHSA-6rg3-8h8x-5xfv) that prevents accessing internal endpoints of the node hosting Wings in the pull endpoint. Thishttps://patchthecve.com/cve/CVE-2024-34067.htmlhttps://patchthecve.com/cve/CVE-2024-34067.htmlWed, 17 Jun 2026 07:32:50 +0000MEDIUM 6.1: Pterodactyl is a free, open-source game server management panel built with PHP, React, and Go. Importing a malicious egg or gaining access to wings instance could lead to cross site scripting (XSS) on the panel, which could be used to gain an administrator account on the panel. Specifically, the folhttps://patchthecve.com/cve/CVE-2024-34066.htmlhttps://patchthecve.com/cve/CVE-2024-34066.htmlWed, 17 Jun 2026 07:32:50 +0000HIGH 8.4: Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to. This issue has