https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-50130.htmlhttps://patchthecve.com/cve/CVE-2026-50130.htmlThu, 30 Jul 2026 14:31:09 +0000HIGH 8.8: Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownershihttps://patchthecve.com/cve/CVE-2026-35521.htmlhttps://patchthecve.com/cve/CVE-2026-35521.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.8: FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts). This vulnerability allows an authentihttps://patchthecve.com/cve/CVE-2026-35520.htmlhttps://patchthecve.com/cve/CVE-2026-35520.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.8: FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP lease time configuration parameter (dhcp.leaseTime). This vulnerability allows anhttps://patchthecve.com/cve/CVE-2026-35519.htmlhttps://patchthecve.com/cve/CVE-2026-35519.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.8: FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS host record configuration parameter (dns.hostRecord). This vulnerability allows anhttps://patchthecve.com/cve/CVE-2026-35518.htmlhttps://patchthecve.com/cve/CVE-2026-35518.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.8: FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS CNAME records configuration parameter (dns.cnameRecords). This vulnerability allowhttps://patchthecve.com/cve/CVE-2026-35517.htmlhttps://patchthecve.com/cve/CVE-2026-35517.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 8.8: FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the upstream DNS servers configuration parameter (dns.upstreams). This vulnerability allowhttps://patchthecve.com/cve/CVE-2026-35491.htmlhttps://patchthecve.com/cve/CVE-2026-35491.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 6.1: FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, Pi-hole FTL supports a CLI password feature (webserver.api.cli_pw) that creates “CLI” API sessions intended to be read-only for configuration changes. While /api/config https://patchthecve.com/cve/CVE-2026-33405.htmlhttps://patchthecve.com/cve/CVE-2026-33405.htmlMon, 26 Oct 2026 22:10:00 +0000LOW 3.1: Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the formatInfo() function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML without escaping when a user expands a quehttps://patchthecve.com/cve/CVE-2026-33406.htmlhttps://patchthecve.com/cve/CVE-2026-33406.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 5.4: Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js, enablihttps://patchthecve.com/cve/CVE-2026-33404.htmlhttps://patchthecve.com/cve/CVE-2026-33404.htmlMon, 26 Oct 2026 22:10:00 +0000LOW 3.4: Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client hostnames and IP addresses from the FTL database are rendered into the DOM without escaping in network.js (Network page) and charts.js/index.jhttps://patchthecve.com/cve/CVE-2026-33403.htmlhttps://patchthecve.com/cve/CVE-2026-33403.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 6.1: Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a reflected DOM-based XSS vulnerability in taillog.js allows an unauthenticated attacker to inject arbitrary HTML into the Pi-hole admin interface byhttps://patchthecve.com/cve/CVE-2026-33765.htmlhttps://patchthecve.com/cve/CVE-2026-33765.htmlMon, 26 Oct 2026 22:10:00 +0000CRITICAL 9.8: Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions prior to 6.0 have a critical OS Command Injection vulnerability in the savesettings.php file. The application takes the user-controlled $_POST['webtheme'] parameter