# cve.now: Pi-hole

The newest entries naming Pi-hole as an affected vendor (up to 200), of 38 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119336](https://cve.now/CVE-2026-119336.md): Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink (CVSS 7.8)
- [CVE-2026-119335](https://cve.now/CVE-2026-119335.md): Pi-hole: Local privilege escalation from \`pihole\` user to root via CVE-2026-41489 fix bypass (CVSS 7.8)
- [CVE-2026-119334](https://cve.now/CVE-2026-119334.md): Pi-hole: file:// adlist read check and curl can resolve different files (CVSS 2.2)
- [CVE-2026-50130](https://cve.now/CVE-2026-50130.md): Pi-hole: Local privilege escalation from \`pihole\` user to root via \`/etc/pihole/logrotate\` (CVSS 8.8)
- [CVE-2026-44693](https://cve.now/CVE-2026-44693.md): Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer (CVSS 8.8)
- [CVE-2026-41489](https://cve.now/CVE-2026-41489.md): Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks (CVSS 8.8)
- [CVE-2026-39849](https://cve.now/CVE-2026-39849.md): Pi-hole FTL remote code execution via newline injection in dns.interface configuration (CVSS 8.7)
- [CVE-2026-35521](https://cve.now/CVE-2026-35521.md): Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection (CVSS 8.8)
- [CVE-2026-35520](https://cve.now/CVE-2026-35520.md): Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection (CVSS 8.8)
- [CVE-2026-35519](https://cve.now/CVE-2026-35519.md): Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection (CVSS 8.8)
- [CVE-2026-35518](https://cve.now/CVE-2026-35518.md): Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection (CVSS 8.8)
- [CVE-2026-35517](https://cve.now/CVE-2026-35517.md): Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection (CVSS 8.8)
- [CVE-2026-35491](https://cve.now/CVE-2026-35491.md): Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration (CVSS 6.1)
- [CVE-2026-33405](https://cve.now/CVE-2026-33405.md): Pi-hole has a Stored HTML Injection in queries.js (CVSS 3.1)
- [CVE-2026-33727](https://cve.now/CVE-2026-33727.md): Pi-hole has a Local Privilege Escalation (post-compromise, pihole -\> root). (CVSS 6.4)
- [CVE-2026-33406](https://cve.now/CVE-2026-33406.md): Pi-hole has a Stored HTML attribute injection (CVSS 5.4)
- [CVE-2026-33404](https://cve.now/CVE-2026-33404.md): Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboard (CVSS 3.4)
- [CVE-2026-33403](https://cve.now/CVE-2026-33403.md): Pi-hole has a Reflected XSS / HTML injection in taillog.js (CVSS 6.1)
- [CVE-2026-33765](https://cve.now/CVE-2026-33765.md): Pi-hole Web Interface has a Command Injection Vulnerability (CVSS 8.9)
- [CVE-2026-26953](https://cve.now/CVE-2026-26953.md): Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table (CVSS 5.4)
- [CVE-2026-26952](https://cve.now/CVE-2026-26952.md): Pi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attribute (CVSS 5.4)
- [CVE-2025-59151](https://cve.now/CVE-2025-59151.md): Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection (CVSS 8.2)
- [CVE-2025-53533](https://cve.now/CVE-2025-53533.md): Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page (CVSS 5.1)
- [CVE-2025-32785](https://cve.now/CVE-2025-32785.md): Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field) (CVSS 2.0)
- [CVE-2025-34087](https://cve.now/CVE-2025-34087.md): Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution (CVSS 9.0)
- [CVE-2024-34361](https://cve.now/CVE-2024-34361.md): Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE) (CVSS 8.6)
- [CVE-2024-28247](https://cve.now/CVE-2024-28247.md): Pihole Authenticated Arbitrary File Read with root privileges (CVSS 7.6)
- [CVE-2023-23614](https://cve.now/CVE-2023-23614.md): Improper session handling of "Remember me for 7 days" functionality (CVSS 8.8)
- [CVE-2022-23513](https://cve.now/CVE-2022-23513.md): Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint (CVSS 5.3)
- [CVE-2022-31029](https://cve.now/CVE-2022-31029.md): Authenticated XSS in Pi-hole AdminLTE (CVSS 5.9)
- [CVE-2021-41175](https://cve.now/CVE-2021-41175.md): Stored XSS in Client Groups Management (Authenticated) (CVSS 7.3)
- [CVE-2021-3812](https://cve.now/CVE-2021-3812.md): Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte (CVSS 6.7)
- [CVE-2021-3811](https://cve.now/CVE-2021-3811.md): Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte (CVSS 6.7)
- [CVE-2021-3706](https://cve.now/CVE-2021-3706.md): Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte (CVSS 7.4)
- [CVE-2021-32793](https://cve.now/CVE-2021-32793.md): Stored XSS Vulnerability in the Pi-hole Webinterface (CVSS 5.7)
- [CVE-2021-32706](https://cve.now/CVE-2021-32706.md): (Authenticated) Remote Code Execution Possible in Web Interface 5.5 (CVSS 7.6)
- [CVE-2021-29448](https://cve.now/CVE-2021-29448.md): Stored DOM XSS in Pi-hole Admin Web Interface (CVSS 7.6)
- [CVE-2021-29449](https://cve.now/CVE-2021-29449.md): Multiple Privilege Escalation Vulnerabilities Pihole (CVSS 6.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/pi-hole
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.