Pi-hole
14 CVEs tracked since 2021. Since Sep 2021, none of them reached CISA KEV.
Pi-hole CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2021-09 | 3 | 0 |
| 2021-10 | null or fewer | |
| 2021-11 | null or fewer | |
| 2021-12 | null or fewer | |
| 2022-01 | null or fewer | |
| 2022-02 | null or fewer | |
| 2022-03 | null or fewer | |
| 2022-04 | null or fewer | |
| 2022-05 | null or fewer | |
| 2022-06 | null or fewer | |
| 2022-07 | null or fewer | |
| 2022-08 | null or fewer | |
| 2022-09 | null or fewer | |
| 2022-10 | null or fewer | |
| 2022-11 | null or fewer | |
| 2022-12 | null or fewer | |
| 2023-01 | null or fewer | |
| 2023-02 | null or fewer | |
| 2023-03 | null or fewer | |
| 2023-04 | null or fewer | |
| 2023-05 | null or fewer | |
| 2023-06 | null or fewer | |
| 2023-07 | null or fewer | |
| 2023-08 | null or fewer | |
| 2023-09 | null or fewer | |
| 2023-10 | null or fewer | |
| 2023-11 | null or fewer | |
| 2023-12 | null or fewer | |
| 2024-01 | null or fewer | |
| 2024-02 | null or fewer | |
| 2024-03 | null or fewer | |
| 2024-04 | null or fewer | |
| 2024-05 | null or fewer | |
| 2024-06 | null or fewer | |
| 2024-07 | null or fewer | |
| 2024-08 | null or fewer | |
| 2024-09 | null or fewer | |
| 2024-10 | null or fewer | |
| 2024-11 | null or fewer | |
| 2024-12 | null or fewer | |
| 2025-01 | null or fewer | |
| 2025-02 | null or fewer | |
| 2025-03 | null or fewer | |
| 2025-04 | null or fewer | |
| 2025-05 | null or fewer | |
| 2025-06 | null or fewer | |
| 2025-07 | null or fewer | |
| 2025-08 | null or fewer | |
| 2025-09 | null or fewer | |
| 2025-10 | null or fewer | |
| 2025-11 | null or fewer | |
| 2025-12 | null or fewer | |
| 2026-01 | null or fewer | |
| 2026-02 | null or fewer | |
| 2026-03 | null or fewer | |
| 2026-04 | 11 | 0 |
Products
The products that kept showing up in Pi-hole's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Pi-hole.
- CVE-2026-50130Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`8.8
- CVE-2026-44693Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer8.8
- CVE-2026-41489Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks8.8
- CVE-2026-39849Pi-hole FTL remote code execution via newline injection in dns.interface configuration8.8
- CVE-2026-35521Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection8.8
- CVE-2026-35520Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection8.8
- CVE-2026-35519Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection8.8
- CVE-2026-35518Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection8.8
- CVE-2026-35517Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection8.8
- CVE-2026-35491Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration6.1
- CVE-2026-33405Pi-hole has a Stored HTML Injection in queries.js3.1
- CVE-2026-33727Pi-hole has a Local Privilege Escalation (post-compromise, pihole -> root).6.4
- CVE-2026-33406Pi-hole has a Stored HTML attribute injection5.4
- CVE-2026-33404Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboard3.4
- CVE-2026-33403Pi-hole has a Reflected XSS / HTML injection in taillog.js6.1
The record
- Peak rank
- #92 in Apr 2026
- Busiest month shown
- Apr 2026, 11 CVEs
- Months with a KEV entry
- 0 since Sep 2021
- Monthly snapshots
- 2 since 2021