FTL

7 results · Clear filters · Feed

• High 8.8
  CVE-2026-44693

  Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer

  Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedd…

  pi-hole FTL
  Jun 10, 2026
• High 8.7
  CVE-2026-39849

  Pi-hole FTL remote code execution via newline injection in dns.interface configuration

  Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. In versions before 6.6.1, the `dns.interface` configuration field in Pi-hole FTL accepted newline characters without validation, allowing an attacker to inject arbi…

  pi-hole FTL
  May 5, 2026
• High 8.8
  CVE-2026-35521

  Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection

  FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.host…

  pi-hole FTL
  Apr 7, 2026
• High 8.8
  CVE-2026-35520

  Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection

  FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP lease time configuration parameter (dhcp…

  pi-hole FTL
  Apr 7, 2026
• High 8.8
  CVE-2026-35519

  Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection

  FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS host record configuration parameter (dns.…

  pi-hole FTL
  Apr 7, 2026
• High 8.8
  CVE-2026-35518

  Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection

  FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS CNAME records configuration parameter (dn…

  pi-hole FTL
  Apr 7, 2026
• High 8.8
  CVE-2026-35517 Public exploit

  Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection

  FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the upstream DNS servers configuration parameter …

  pi-hole FTL
  Apr 7, 2026