Vendor

    Pi-hole

    48 known vulnerabilities in products by Pi-hole, 1 of them actively exploited (CISA KEV).

    Key figures

    48

    Vulnerabilities

    1

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Pi-hole
    CriticalCVE-2020-8816

    Pi-Hole AdminLTE Remote Code Execution Vulnerability

    In CISA KEV

    		9.1
    CriticalCVE-2025-34087

    Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution

    		8.8
    HighCVE-2020-11108

    Pi-hole AdminLTE: Privilege Escalation

    		8.8
    HighCVE-2019-13051

    Pi-hole AdminLTE: Command Injection

    		8.8
    HighCVE-2021-32706

    (Authenticated) Remote Code Execution Possible in Web Interface 5.5

    		7.6
    HighCVE-2024-34361

    Pi-hole AdminLTE: Server-Side Request Forgery (SSRF)

    		8.6
    MediumCVE-2022-23513

    Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint

    		5.3
    CriticalCVE-2026-33765

    Pi-hole Web Interface has a Command Injection Vulnerability

    		9.8
    HighCVE-2026-39849

    Pi-hole FTL remote code execution via newline injection in dns.interface configuration

    		8.8
    HighCVE-2026-35517

    Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection

    		8.8
    HighCVE-2024-28247

    Pihole Authenticated Arbitrary File Read with root privileges

    		7.6
    HighCVE-2020-12620

    Pi-hole AdminLTE: Command Injection

    		7.8
    HighCVE-2026-35521

    Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection

    		8.8
    HighCVE-2026-35520

    Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection

    		8.8
    HighCVE-2026-35518

    Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection

    		8.8
    HighCVE-2021-29449

    Multiple Privilege Escalation Vulnerabilities Pihole

    		6.3
    HighCVE-2023-23614

    Improper session handling of "Remember me for 7 days" functionality

    		8.8
    HighCVE-2026-35519

    Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection

    		8.8
    HighCVE-2021-3706

    Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte

    		7.4
    HighCVE-2026-119336

    AdminLTE: Link Following

    		7.8
    HighCVE-2026-119335

    Pi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypass

    		7.8
    HighCVE-2026-50130

    Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`

    		8.8
    HighCVE-2026-44693

    Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer

    		8.8
    HighCVE-2021-41175

    Stored XSS in Client Groups Management (Authenticated)

    		7.3
    HighCVE-2025-59151

    Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection

    		8.2

    All vulnerabilities in search

    News

    Products

    Products by Pi-hole
    AdminLTE231
    AdminLTE160
    Web100
    FTL80
    FTL80
    AdminLTE70
    Pi-hole/adminlte30