https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33405.htmlhttps://patchthecve.com/cve/CVE-2026-33405.htmlMon, 26 Oct 2026 22:10:00 +0000LOW 3.1: Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the formatInfo() function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML without escaping when a user expands a quehttps://patchthecve.com/cve/CVE-2026-33406.htmlhttps://patchthecve.com/cve/CVE-2026-33406.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 5.4: Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js, enablihttps://patchthecve.com/cve/CVE-2026-33404.htmlhttps://patchthecve.com/cve/CVE-2026-33404.htmlMon, 26 Oct 2026 22:10:00 +0000LOW 3.4: Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client hostnames and IP addresses from the FTL database are rendered into the DOM without escaping in network.js (Network page) and charts.js/index.jhttps://patchthecve.com/cve/CVE-2026-33403.htmlhttps://patchthecve.com/cve/CVE-2026-33403.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 6.1: Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a reflected DOM-based XSS vulnerability in taillog.js allows an unauthenticated attacker to inject arbitrary HTML into the Pi-hole admin interface byhttps://patchthecve.com/cve/CVE-2026-33765.htmlhttps://patchthecve.com/cve/CVE-2026-33765.htmlMon, 26 Oct 2026 22:10:00 +0000CRITICAL 9.8: Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions prior to 6.0 have a critical OS Command Injection vulnerability in the savesettings.php file. The application takes the user-controlled $_POST['webtheme'] parameter