Convoypanel Panel vulnerabilities

• convoypanel panel HoloViz Panel from 1.2.2 before 1.9.0 Open Redirect via next Parameter CVE-2024-58389 5.1 MediumOctober 12, 2026
• convoypanel panel Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup CVE-2026-92762 8.7 HighSeptember 16, 2026
• convoypanel panel Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks CVE-2026-86177 8.7 HighSeptember 5, 2026
• convoypanel panel Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions CVE-2026-54593 Fix available 8.1 HighJuly 28, 2026
• convoypanel panel Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS) CVE-2026-61609 Fix available 7.5 HighJuly 28, 2026
• convoypanel panel Pterodactyl has a database resource limit bypass via race condition in Client API CVE-2026-35202 Fix available 2.3 LowMay 26, 2026
• convoypanel panel CtrlPanel: Missing Authorization on Admin Write Endpoints Allows RBAC Bypass CVE-2026-34358 8.1 HighMay 19, 2026
• convoypanel panel CtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output CVE-2026-34246 4.8 MediumMay 19, 2026
• convoypanel panel CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking CVE-2026-34241 8.7 HighMay 19, 2026
• convoypanel panel CtrlPanel: Unauthenticated RCE using installer script CVE-2026-34234 Public exploit 10.0 CriticalMay 19, 2026
• convoypanel panel CtrlPanel has Missing Authentication Checks in Datatable Admin Endpoints CVE-2026-34233 6.5 MediumMay 19, 2026
• convoypanel panel CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php CVE-2026-34216 6.6 MediumMay 19, 2026
• convoypanel convoy, panel +1 more Convoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary Users CVE-2026-33746 9.8 CriticalApril 2, 2026
• convoypanel panel Xiaopi Panel WAF Firewall demo.php cross site scripting CVE-2026-5332 5.1 MediumApril 2, 2026
• convoypanel panel, reviactyl +1 more Reviactyl: OAuth account takeover via auto-linking CVE-2026-34456 9.1 CriticalApril 1, 2026
• convoypanel panel Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization CVE-2026-26016 Fix available 9.2 CriticalFebruary 17, 2026
• convoypanel panel Xiaopi Panel WAF Firewall demo.php sql injection CVE-2026-2122 5.3 MediumFebruary 8, 2026
• convoypanel panel, pterodactyl wings +1 more Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances CVE-2025-69199 Fix available 8.3 HighJanuary 19, 2026
• convoypanel panel Pterodactyl's improper resource locking allows raced queries to create more resources than alloted CVE-2025-69198 Fix available 6.0 MediumJanuary 19, 2026
• convoypanel panel Pterodactyl TOTPs can be reused during validity window CVE-2025-69197 Fix available 6.5 MediumJanuary 6, 2026
• convoypanel panel, pterodactyl wings +1 more Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced CVE-2025-68954 Fix available 7.5 HighJanuary 6, 2026
• convoypanel panel RatPanel can perform remote command execution without authorization CVE-2025-53534 Fix available 7.7 HighAugust 4, 2025
• convoypanel panel Convey Panel Directory Traversal in LocaleController leading to Remote Code Execution CVE-2025-52562 10.0 CriticalJune 23, 2025
• convoypanel panel Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution CVE-2025-49132 Public exploitFix available EPSS 54.5% 10.0 CriticalJune 19, 2025
• convoypanel panel Ctrlpanel has stored XSS vulnerability in TicketsController priority field CVE-2025-25203 8.1 HighFebruary 11, 2025
• convoypanel panel Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled CVE-2024-49762 Fix available 4.6 MediumOctober 24, 2024
• convoypanel panel Directory Browsing in Eliz Software's Panel CVE-2024-6878 9.2 CriticalSeptember 18, 2024
• convoypanel panel Reflected XSS in Eliz Software's Panel CVE-2024-6877 9.4 CriticalSeptember 18, 2024
• convoypanel panel Plaintext Storage of a Password in Eliz Software's Panel CVE-2024-5960 9.8 CriticalSeptember 18, 2024
• convoypanel panel Stored XSS in Eliz Software's Panel CVE-2024-5959 9.3 CriticalSeptember 18, 2024
• convoypanel panel SQLi in Eliz Software's Panel CVE-2024-5958 9.4 CriticalSeptember 18, 2024
• convoypanel panel Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel CVE-2024-34067 Fix available 6.1 MediumMay 3, 2024
• convoypanel panel Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys CVE-2021-41273 Fix available 4.3 MediumNovember 17, 2021
• convoypanel panel logout CSRF in Pterodactyl Panel CVE-2021-41176 Fix available 4.3 MediumOctober 25, 2021
• convoypanel panel Authentication bypass in Pterodactyl CVE-2021-41129 Fix available 8.1 HighOctober 4, 2021