Pi-hole

Records48All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high28CVSS 7.0–8.9

Exploited now

Pi-hole records in CISA KEV

TI-2020-07073 Pi-Hole AdminLTE Remote Code Execution Vulnerability CRITICAL 91KEV 2021-12-10

Components

Products in the NVD configurations · select one to filter the records

Pi-hole 19 records CRITICAL Web Interface 16 records HIGH Ftldns 8 records HIGH Adminlte 2 records MEDIUM

Records

8 records in Ftldns · all components

TI-2026-28731 CVE-2026-39849

Pi-hole FTL remote code execution via newline injection in dns.interface configuration

HIGH 73

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00956 Published 2026-05-05 Fixed in 6.6.1 CWE-93

TI-2026-27638 CVE-2026-35521

Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection

HIGH 73

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00713 Published 2026-04-07 Fixed in 6.6 CWE-78

TI-2026-27637 CVE-2026-35520

Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection

HIGH 73

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00713 Published 2026-04-07 Fixed in 6.6 CWE-78

TI-2026-27636 CVE-2026-35519

Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection

HIGH 73

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00547 Published 2026-04-07 Fixed in 6.6 CWE-78

TI-2026-27635 CVE-2026-35518

Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection

HIGH 73

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00713 Published 2026-04-07 Fixed in 6.6 CWE-78

TI-2026-27634 CVE-2026-35517

Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection

HIGH 73

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00874 Published 2026-04-07 Fixed in 6.6 CWE-78

TI-2026-27620 CVE-2026-35491

Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration

MEDIUM 60

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.

CVSS 3.1MEDIUM 6.1 Local Low privileges No interaction EPSS 0.00162 Published 2026-04-07 Fixed in 6.6 CWE-863

TI-2021-10161 CVE-2021-29448

Stored DOM XSS in Pi-hole Admin Web Interface

LOW 39

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00692 Published 2021-04-15 No fix listed CWE-79

Open these records in search →