https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-35521.htmlhttps://patchthecve.com/cve/CVE-2026-35521.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.8: FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts). This vulnerability allows an authentihttps://patchthecve.com/cve/CVE-2026-35520.htmlhttps://patchthecve.com/cve/CVE-2026-35520.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.8: FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP lease time configuration parameter (dhcp.leaseTime). This vulnerability allows anhttps://patchthecve.com/cve/CVE-2026-35519.htmlhttps://patchthecve.com/cve/CVE-2026-35519.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.8: FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS host record configuration parameter (dns.hostRecord). This vulnerability allows anhttps://patchthecve.com/cve/CVE-2026-35518.htmlhttps://patchthecve.com/cve/CVE-2026-35518.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.8: FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS CNAME records configuration parameter (dns.cnameRecords). This vulnerability allowhttps://patchthecve.com/cve/CVE-2026-35517.htmlhttps://patchthecve.com/cve/CVE-2026-35517.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 8.8: FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the upstream DNS servers configuration parameter (dns.upstreams). This vulnerability allowhttps://patchthecve.com/cve/CVE-2026-35491.htmlhttps://patchthecve.com/cve/CVE-2026-35491.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 6.1: FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, Pi-hole FTL supports a CLI password feature (webserver.api.cli_pw) that creates “CLI” API sessions intended to be read-only for configuration changes. While /api/config