Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

Summary A privilege escalation vulnerability exists in the Wings /upload/file endpoint due to insufficient validation of panel-signed JWTs. Wings accepts any valid panel-signed JWT containing serveruuid, useruuid, and uniqueid, regardless of the token’s intended purpose. Because the Panel issues...

CVE-2026-54593 Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...

CVE-2026-54593

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...

CVE-2026-54593 Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...

EUVD-2026-49880

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...

CVE-2026-54593 Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...

CVE-2026-54593

Vulnerability summary: CVE-2026-54593 affects Pterodactyl Panel and Wings prior to versions 1.12.3 and 1.12.2, respectively. The Wings /upload/file endpoint accepted any valid panel-signed JWT containing server_uuid, user_uuid, and unique_id without enforcing the intended purpose. Since Panel iss...

MAL-2026-11156 Malicious code in vtranalytic (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897fa80f1d8a55ff480d6c7e7a71200ac31530a9f5d928389545b597c7b45903 The package implements a full remote-administration toolkit controlled through a Telegram bot. It polls the Telegram Bot API at...

MAL-2026-11125 Malicious code in api-rust-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 268179cffa6aef31ad248757e61fc892cb826bde059502b3e2c3a74277951e05 On npm install, the package's postinstall hook node test.js executes two payloads against the installer host. First, it fetches an attacker-controlle...

MAL-2026-11124 Malicious code in api-node-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8133fdea40df12d51091c8ce094062f366f0c30be0d17667a827ed00b75f78a On npm install, the package's postinstall hook node test.js executes an attacker-controlled workflow against the installer's host. It recursively sca...

CVE-2026-15012 Demi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handlerestorestep function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/...

SugarCRM Unauthenticated - Remote Code Execution

In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. id: CVE-2023-22952 info: name: SugarCRM Unauthenticated - Remote Code Execution author: iamnoooob,rootxharsh,pdresearch severity: high description: |...

PT-2026-65625

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.5 Description The multipart upload handler in the httpserver/updown.go file splits the part.FileName on the path separator but fails to reject the .. sequence. This allows an unauthenticated user to upload a file wi...

PT-2026-65514

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server uuid, user uuid, and unique id claims without checking the token's intended purpose;...

CVE-2026-55579

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the...

CVE-2026-55579

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the...

CVE-2026-66398

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATIONEDIT and ATTACHMENTADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload ...

CVE-2026-66398 phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATIONEDIT and ATTACHMENTADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload ...

EUVD-2026-49331

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATIONEDIT and ATTACHMENTADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload ...

CVE-2026-10600

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server v...