CVE-2026-52856

HighCVSS 7.5/10Last modified Oct 23, 2026

Description

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-129 CWE-248 CWE-617 CWE-755

Affected software

Vendor	Product	Versions
pterodactyl	wings	< 1.13.0

References

Timeline

Published: Jul 31, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-528575.5Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, CVE-2026-528587.8Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim CVE-2026-528598.2Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visi CVE-2026-52868.8Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page.CVE-2026-528607.8Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and CVE-2026-528635.9In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow CVE-2026-528656.5When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or CVE-2026-528666.5An attacker within BLE communication range can monopolize the device's only available BLE connection slot, preventing legitimate users or CVE-2026-528688.2An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area. In a multi-area de CVE-2026-528697.1The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and statefu CVE-2026-52878.8Use after free in PDF in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr CVE-2026-528707.6The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default ha