Vendor
high
threat
Pterodactyl Wings Privilege Escalation via Improper JWT Scoping (CVE-2026-54593)
1 rule 1 TTPA privilege escalation vulnerability, CVE-2026-54593, exists in Pterodactyl's Wings component that allows authenticated subusers to upload arbitrary files to a server without explicit file creation permissions, due to insufficient validation of panel-signed JSON Web Tokens (JWTs.
Pterodactyl Panel +1
Unauthorized Subuser
privilege-escalation
vulnerability
JWT
Pterodactyl
web-server
1r
1t
medium
advisory
Pterodactyl Panel Global Rate-Limit Vulnerability Enables Unauthenticated DoS (CVE-2026-61609)
1 rule 2 TTPsAn unauthenticated attacker can exploit CVE-2026-61609, a global rate-limit vulnerability in Pterodactyl Panel versions up to and including 1.12.4, by sending approximately 10 requests per minute to authentication endpoints, leading to a panel-wide denial of service for all legitimate users and administrators attempting to log in or complete 2FA.
Panel
denial-of-service
vulnerability
web-application
pterodactyl
1r
2t