Pi-hole vulnerabilities

Products

• Pi-hole 23
• Web Interface 16
• Web 10
• Adminlte 8
• Ftl 8
• Ftldns 8
• Pi-hole/adminlte 3

Newest

• pi-hole Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink CVE-2026-119336 7.8 HighOctober 30, 2026
• pi-hole Pi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypass CVE-2026-119335 7.8 HighOctober 30, 2026
• pi-hole Pi-hole: file:// adlist read check and curl can resolve different files CVE-2026-119334 2.2 LowOctober 30, 2026
• pi-hole Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate` CVE-2026-50130 8.8 HighJuly 14, 2026
• pi-hole ftl Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer CVE-2026-44693 8.8 HighJune 10, 2026
• pi-hole Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks CVE-2026-41489 8.8 HighMay 11, 2026
• pi-hole ftl, ftldns +1 more Pi-hole FTL remote code execution via newline injection in dns.interface configuration CVE-2026-39849 8.7 HighMay 5, 2026
• pi-hole ftl, ftldns +1 more Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection CVE-2026-35521 8.8 HighApril 7, 2026
• pi-hole ftl, ftldns +1 more Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection CVE-2026-35520 8.8 HighApril 7, 2026
• pi-hole ftl, ftldns +1 more Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection CVE-2026-35519 8.8 HighApril 7, 2026
• pi-hole ftl, ftldns +1 more Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection CVE-2026-35518 8.8 HighApril 7, 2026
• pi-hole ftl, ftldns +1 more Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection CVE-2026-35517 Public exploit 8.8 HighApril 7, 2026
• pi-hole ftl, ftldns +1 more Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration CVE-2026-35491 6.1 MediumApril 7, 2026
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole has a Stored HTML Injection in queries.js CVE-2026-33405 3.1 LowApril 6, 2026
• pi-hole Pi-hole has a Local Privilege Escalation (post-compromise, pihole -> root). CVE-2026-33727 6.4 MediumApril 6, 2026
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole has a Stored HTML attribute injection CVE-2026-33406 5.4 MediumApril 6, 2026
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboard CVE-2026-33404 3.4 LowApril 6, 2026
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole has a Reflected XSS / HTML injection in taillog.js CVE-2026-33403 6.1 MediumApril 6, 2026
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole Web Interface has a Command Injection Vulnerability CVE-2026-33765 8.9 HighMarch 27, 2026
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table CVE-2026-26953 5.4 MediumFebruary 19, 2026
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attribute CVE-2026-26952 5.4 MediumFebruary 19, 2026
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection CVE-2025-59151 8.2 HighOctober 27, 2025
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page CVE-2025-53533 Public exploit 5.1 MediumOctober 27, 2025
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field) CVE-2025-32785 2.0 LowOctober 27, 2025
• com.ritense.valtimo web, pi-hole +1 more Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution CVE-2025-34087 Public exploit 9.0 CriticalJuly 3, 2025
• pi-hole Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the... CVE-2024-44069 Disputed 7.5 HighAugust 19, 2024
• pi-hole Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE) CVE-2024-34361 Public exploit 8.6 HighJuly 5, 2024
• pi-hole Pihole Authenticated Arbitrary File Read with root privileges CVE-2024-28247 Public exploit 7.6 HighMarch 27, 2024
• pi-hole adminlte, web interface +1 more Improper session handling of "Remember me for 7 days" functionality CVE-2023-23614 8.8 HighJanuary 26, 2023
• pi-hole adminlte Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint CVE-2022-23513 Public exploit EPSS 42.3% 5.3 MediumDecember 22, 2022
• pi-hole adminlte Authenticated XSS in Pi-hole AdminLTE CVE-2022-31029 5.9 MediumJuly 7, 2022
• pi-hole adminlte, web interface +1 more Stored XSS in Client Groups Management (Authenticated) CVE-2021-41175 7.3 HighOctober 26, 2021
• pi-hole pi-hole/adminlte, web interface +1 more Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte CVE-2021-3812 6.7 MediumSeptember 17, 2021
• pi-hole pi-hole/adminlte, web interface +1 more Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte CVE-2021-3811 6.7 MediumSeptember 17, 2021
• pi-hole pi-hole/adminlte, web interface +1 more Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte CVE-2021-3706 7.4 HighSeptember 15, 2021
• pi-hole, pi-hole adminlte +1 more Stored XSS Vulnerability in the Pi-hole Webinterface CVE-2021-32793 5.7 MediumAugust 4, 2021
• pi-hole, pi-hole adminlte +1 more (Authenticated) Remote Code Execution Possible in Web Interface 5.5 CVE-2021-32706 EPSS 60.2% 7.6 HighAugust 4, 2021
• pi-hole, pi-hole web interface, adminlte +1 more +3 more Stored DOM XSS in Pi-hole Admin Web Interface CVE-2021-29448 7.6 HighApril 15, 2021
• pi-hole Multiple Privilege Escalation Vulnerabilities Pihole CVE-2021-29449 Public exploit 6.3 MediumApril 14, 2021
• pi-hole Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is... CVE-2020-35592 5.4 MediumFebruary 18, 2021
• pi-hole Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The application does not generate a new... CVE-2020-35591 5.4 MediumFebruary 18, 2021
• pi-hole The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. An attacker with the... CVE-2020-35659 6.1 MediumDecember 24, 2020
• pi-hole An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to... CVE-2020-14162 7.8 HighJuly 30, 2020
• pi-hole Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges... CVE-2020-12620 7.8 HighJuly 30, 2020
• pi-hole Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by... CVE-2020-14971 7.8 HighJune 23, 2020
• pi-hole adminlte, pi-hole +1 more Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via... CVE-2020-8816 In KEVPublic exploit EPSS 78.3% 9.1 CriticalMay 29, 2020
• pi-hole The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary... CVE-2020-11108 Public exploit EPSS 78.3% 8.8 HighMay 11, 2020
• pi-hole Pi-Hole 4.3 allows Command Injection. CVE-2019-13051 Public exploit EPSS 12.5% 8.8 HighOctober 9, 2019