pi-hole

Products

Exploited and recent CVEs

• CVE-2026-119336 High 7.8 Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink 0.2%
• CVE-2026-119335 High 7.8 Pi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypass 0.2%
• CVE-2026-119334 Low 2.2 Pi-hole: file:// adlist read check and curl can resolve different files 0.3%
• CVE-2026-50130 High 8.8 Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate` 0.3%
• CVE-2026-44693 High 8.8 Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer 0.3%
• CVE-2026-41489 High 8.8 Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks 0.1%
• CVE-2026-39849 High 8.7 Pi-hole FTL remote code execution via newline injection in dns.interface configuration 1.0%
• CVE-2026-35521 High 8.8 Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection 0.7%
• CVE-2026-35520 High 8.8 Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection 0.7%
• CVE-2026-35519 High 8.8 Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection 0.5%
• CVE-2026-35518 High 8.8 Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection 0.7%
• CVE-2026-35517 High 8.8 Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection 0.9%
• CVE-2026-35491 Medium 6.1 Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration 0.2%
• CVE-2026-33405 Low 3.1 Pi-hole has a Stored HTML Injection in queries.js 0.2%
• CVE-2026-33727 Medium 6.4 Pi-hole has a Local Privilege Escalation (post-compromise, pihole -> root). 0.2%
• CVE-2026-33406 Medium 5.4 Pi-hole has a Stored HTML attribute injection 0.3%
• CVE-2026-33404 Low 3.4 Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboard 0.1%
• CVE-2026-33403 Medium 6.1 Pi-hole has a Reflected XSS / HTML injection in taillog.js 0.2%
• CVE-2026-33765 High 8.9 Pi-hole Web Interface has a Command Injection Vulnerability 1.3%
• CVE-2026-26953 Medium 5.4 Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table 0.3%
• CVE-2026-26952 Medium 5.4 Pi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attribute 0.3%
• CVE-2025-59151 High 8.2 Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection 0.4%
• CVE-2025-53533 Medium 5.1 Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page 0.6%
• CVE-2025-32785 Low 2.0 Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field) 0.2%
• CVE-2024-34361 High 8.6 Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE) 2.8%
• CVE-2024-28247 High 7.6 Pihole Authenticated Arbitrary File Read with root privileges 1.4%
• CVE-2023-23614 High 8.8 Improper session handling of "Remember me for 7 days" functionality 1.0%
• CVE-2022-23513 Medium 5.3 Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint 42.3%
• CVE-2022-31029 Medium 5.9 Authenticated XSS in Pi-hole AdminLTE 0.5%
• CVE-2021-41175 High 7.3 Stored XSS in Client Groups Management (Authenticated) 0.9%