GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings