Login Request a demo
PI
Product
pi-hole
by pi-hole · last CVE Jul 14, 2026
On CISA KEVExploited in the wild
20
CVEs
1
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities20In the news0Timeline
Severity mix
Critical 0High 14Medium 6Low 0
Severity
All severities20Critical0High14Medium6Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add pi-hole to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-8816
In wildKEV
7.2
78%
May 29
Pi-Hole AdminLTE Remote Code Execution Vulnerability
Affected: through 4.3.2
CVE-2026-50130
8.8
0%
Jul 14
Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`
Affected: >= 6.0.0, < 6.4.3
CVE-2026-41489
8.8
0%
May 11
Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks
Affected: >= 6.0, < 6.4.2
CVE-2025-34087
8.8
7%
Jul 3
Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution
Affected: through 3.3
CVE-2024-34361
8.8
3%
Jul 5
Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)
Affected: < 5.18.3
CVE-2021-32706
8.8
60%
Aug 4
(Authenticated) Remote Code Execution Possible in Web Interface 5.5
Affected: before 5.5.1
CVE-2021-29448
8.8
1%
Apr 15
Stored DOM XSS in Pi-hole Admin Web Interface
Affected: 5.2.4
CVE-2020-11108
8.8
78%
May 11
The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files
Affected: through 4.4
CVE-2019-13051
8.8
12%
Oct 9
Pi-Hole 4.3 allows Command Injection
Affected: 4.3
CVE-2021-29449
7.8
2%
Apr 14
Multiple Privilege Escalation Vulnerabilities Pihole
Affected: <= 5.2.4
CVE-2020-14162
7.8
1%
Jul 30
An issue was discovered in Pi-Hole through 5.0
Affected: before 5.1
CVE-2020-12620
7.8
2%
Jul 30
Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP address)
Affected: before 5.0
CVE-2020-14971
7.8
1%
Jun 23
Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them
Affected: through 5.0
CVE-2024-44069
7.5
0%
Aug 19
Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard
Affected: before 6.0
Showing 14