Login Request a demo
PI
Vendor
pi-hole
7 products with CVEs on record
73
CVEs
2
On KEV
0
New 30D
Products
PI
pi-hole
pi-hole
8.8
20 CVEs1 on KEV0 new
AD
AdminLTE
pi-hole
8.8
8 CVEs1 on KEV0 new
WI
Web Interface
Pi-hole
9.8
16 CVEs0 on KEV0 new
WE
web
pi-hole
9.8
10 CVEs0 on KEV0 new
FT
FTL
pi-hole
8.8
8 CVEs0 on KEV0 new
FT
Ftldns
Pi-hole
8.8
8 CVEs0 on KEV0 new
PI
pi-hole/adminlte
pi-hole
7.5
3 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-50130
PI
pi-hole
pi-hole
8.8
0%
Jul 14Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`
CVE-2026-44693
FT
FTL
pi-hole
8.8
0%
Jun 10Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer
CVE-2026-41489
PI
pi-hole
pi-hole
8.8
0%
May 11Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks
CVE-2026-39849
FT
FTL
pi-hole
8.8
1%
May 5Pi-hole FTL remote code execution via newline injection in dns.interface configuration
CVE-2026-35521
FT
FTL
pi-hole
8.8
1%
Apr 7Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection
CVE-2026-35520
FT
FTL
pi-hole
8.8
1%
Apr 7Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection
CVE-2026-35519
FT
FTL
pi-hole
8.8
1%
Apr 7Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection
CVE-2026-35518
FT
FTL
pi-hole
8.8
1%
Apr 7Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection
CVE-2026-35517
FT
FTL
pi-hole
8.8
1%
Apr 7Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection
CVE-2026-35491
FT
FTL
pi-hole
6.1
0%
Apr 7Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration
CVE-2026-33405
WE
web
pi-hole
4.8
0%
Apr 6Pi-hole has a Stored HTML Injection in queries.js
CVE-2026-33727
PI
pi-hole
pi-hole
6.7
0%
Apr 6Pi-hole has a Local Privilege Escalation (post-compromise, pihole -> root).
CVE-2026-33406
WE
web
pi-hole
6.1
0%
Apr 6Pi-hole has a Stored HTML attribute injection
CVE-2026-33404
WE
web
pi-hole
6.1
0%
Apr 6Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboard
CVE-2026-33403
WE
web
pi-hole
6.1
0%
Apr 6Pi-hole has a Reflected XSS / HTML injection in taillog.js
CVE-2026-33765
WE
web
pi-hole
9.8
1%
Mar 27Pi-hole Web Interface has a Command Injection Vulnerability
CVE-2026-26953
WE
web
pi-hole
5.4
0%
Feb 19Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table
CVE-2026-26952
WE
web
pi-hole
5.4
0%
Feb 19Pi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attribute
CVE-2025-59151
WE
web
pi-hole
8.2
0%
Oct 27Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection
CVE-2025-53533
WE
web
pi-hole
6.1
1%
Oct 27Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page
CVE-2025-32785
WE
web
pi-hole
5.4
0%
Oct 27Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field)
CVE-2025-34087
PI
Pi-hole
Pi-hole
8.8
7%
Jul 3Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution
CVE-2024-44069
PI
Pi-hole
Pi-hole
7.5
0%
Aug 19Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard
CVE-2024-34361
PI
pi-hole
pi-hole
8.8
3%
Jul 5Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)
CVE-2024-28247
PI
pi-hole
pi-hole
6.5
1%
Mar 27Pihole Authenticated Arbitrary File Read with root privileges
CVE-2023-23614
AD
AdminLTE
pi-hole
8.8
1%
Jan 26Improper session handling of "Remember me for 7 days" functionality
CVE-2022-23513
AD
AdminLTE
pi-hole
5.3
42%
Dec 22Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint
CVE-2022-31029
AD
AdminLTE
pi-hole
4.8
0%
Jul 7Authenticated XSS in Pi-hole AdminLTE
CVE-2021-41175
AD
AdminLTE
pi-hole
5.4
1%
Oct 26Stored XSS in Client Groups Management (Authenticated)
CVE-2021-3812
PI
pi-hole/adminlte
pi-hole
6.1
1%
Sep 17Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte
CVE-2021-3811
PI
pi-hole/adminlte
pi-hole
6.1
1%
Sep 17Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte
CVE-2021-3706
PI
pi-hole/adminlte
pi-hole
7.5
1%
Sep 15Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte
CVE-2021-32793
AD
AdminLTE
pi-hole
4.8
1%
Aug 4Stored XSS Vulnerability in the Pi-hole Webinterface
CVE-2021-32706
AD
AdminLTE
pi-hole
8.8
60%
Aug 4(Authenticated) Remote Code Execution Possible in Web Interface 5.5
CVE-2021-29448
AD
AdminLTE
pi-hole
8.8
1%
Apr 15Stored DOM XSS in Pi-hole Admin Web Interface
CVE-2021-29449
PI
pi-hole
pi-hole
7.8
2%
Apr 14Multiple Privilege Escalation Vulnerabilities Pihole
CVE-2020-35592
PI
Pi-hole
Pi-hole
5.4
1%
Feb 18Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI
CVE-2020-35591
PI
Pi-hole
Pi-hole
5.4
1%
Feb 18Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation
CVE-2020-35659
PI
Pi-hole
Pi-hole
6.1
1%
Dec 24The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS
CVE-2020-14162
PI
Pi-hole
Pi-hole
7.8
1%
Jul 30An issue was discovered in Pi-Hole through 5.0
CVE-2020-12620
PI
Pi-hole
Pi-hole
7.8
2%
Jul 30Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP address)
CVE-2020-14971
PI
Pi-hole
Pi-hole
7.8
1%
Jun 23Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them
CVE-2020-8816
In wildKEV
PI
Pi-hole
Pi-hole
7.2
78%
May 29Pi-Hole AdminLTE Remote Code Execution Vulnerability
CVE-2020-11108
PI
Pi-hole
Pi-hole
8.8
78%
May 11The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files
CVE-2019-13051
PI
Pi-hole
Pi-hole
8.8
12%
Oct 9Pi-Hole 4.3 allows Command Injection