PI
Product
pi-hole
On CISA KEVExploited in the wild
20
CVEs
1
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 14Medium 6Low 0
Watch
Add pi-hole to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-8816 In wildKEV | 7.2 | May 29 | Pi-Hole AdminLTE Remote Code Execution Vulnerability Affected: through 4.3.2 |
| CVE-2026-50130 | 8.8 | Jul 14 | Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate` Affected: >= 6.0.0, < 6.4.3 |
| CVE-2026-41489 | 8.8 | May 11 | Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks Affected: >= 6.0, < 6.4.2 |
| CVE-2025-34087 | 8.8 | Jul 3 | Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution Affected: through 3.3 |
| CVE-2024-34361 | 8.8 | Jul 5 | Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE) Affected: < 5.18.3 |
| CVE-2021-32706 | 8.8 | Aug 4 | (Authenticated) Remote Code Execution Possible in Web Interface 5.5 Affected: before 5.5.1 |
| CVE-2021-29448 | 8.8 | Apr 15 | Pi-hole is a Linux network-level advertisement and Internet tracker blocking application Affected: 5.2.4 |
| CVE-2020-11108 | 8.8 | May 11 | The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files Affected: through 4.4 |
| CVE-2019-13051 | 8.8 | Oct 9 | Pi-Hole 4.3 allows Command Injection Affected: 4.3 |
| CVE-2021-29449 | 7.8 | Apr 14 | Pi-hole is a Linux network-level advertisement and Internet tracker blocking application Affected: through 5.2.4 |
| CVE-2020-14162 | 7.8 | Jul 30 | An issue was discovered in Pi-Hole through 5.0 Affected: before 5.1 |
| CVE-2020-12620 | 7.8 | Jul 30 | Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP address) Affected: before 5.0 |
| CVE-2020-14971 | 7.8 | Jun 23 | Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them Affected: through 5.0 |
| CVE-2024-44069 | 7.5 | Aug 19 | Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard Affected: before 6.0 |
| CVE-2026-33727 | 6.7 | Apr 6 | Pi-hole has a Local Privilege Escalation (post-compromise, pihole -> root). Affected: >= 6.4, < 6.4.1 |
| CVE-2024-28247 | 6.5 | Mar 27 | Pihole Authenticated Arbitrary File Read with root privileges Affected: > 5.18 |
| CVE-2020-35659 | 6.1 | Dec 24 | The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS Affected: before 5.2.2 |
| CVE-2020-35592 | 5.4 | Feb 18 | Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI Affected: 5.0; 5.1; 5.1.1 |
| CVE-2020-35591 | 5.4 | Feb 18 | Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation Affected: 5.0; 5.1; 5.1.1 |
| CVE-2021-32793 | 4.8 | Aug 4 | Stored XSS Vulnerability in the Pi-hole Webinterface Affected: before 5.5.1 |
Showing 20