Threats Tagged 'cve-2026-33406'
View all threats tagged with 'cve-2026-33406'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-33406'
Click on any threat for detailed analysis and mitigation recommendations
0 CVE-2026-33406 is a medium severity cross-site scripting (XSS) vulnerability in the Pi-hole Admin Interface web application versions 6.0 up to but not including 6.5. It arises from improper neutralization of input when configuration values from the /api/config endpoint are inserted directly into HTML attribute values without escaping, allowing injection of HTML attributes. Although JavaScript execution is blocked by the server's Content Security Policy (CSP), the injected attributes can manipulate element styling, enabling UI redressing attacks. The main attack vector is importing a malicious teleporter backup, which circumvents per-field server-side validation. This vulnerability has been fixed in Pi-hole version 6.5. Join the discussion | CVE Database V5 | 04/06/2026, 14:50:35 UTC Added: 04/06/2026, 15:15:36 UTC |
Showing 1 to 1 of 1 result