podman exec pihole pihole -v → Core v6.4.3 (latest v6.5), Web v6.6 (latest v6.6.1),
FTL v6.7.1 (latest v6.8); image is pihole/pihole:latest, label 2026.09.0 built 2026-09-19.
Rows listed in the working page are the advisories published on/after that build date. Two more
(GHSA-gx63-h4w6-f46g, GHSA-7997-2868-rjfg) were published the same day the image was built.
Action: pull the current pihole image and pin it (tag@sha256:…), which closes the 6.8/6.6.1/6.5 set, then
finish the deferred half of the pass: diff the 13 older FTL advisories (CVE-2026-65963/65964/71304/65966,
CVE-2026-44693, CVE-2026-39849, CVE-2026-35491/35517/35518/35519/35520/35521, CVE-2025-62165 — several
HIGH/RCE-class) and the 21 older Web advisories against the new build.
**Severity:** 1 FTL **high** ([GHSA-2h7g-g549-hf74](https://github.com/pi-hole/FTL/security/advisories/GHSA-2h7g-g549-hf74)),
plus [GHSA-2794-hrj8-5jg9](https://github.com/pi-hole/FTL/security/advisories/GHSA-2794-hrj8-5jg9) and
[GHSA-ww5x-xx4x-qvjr](https://github.com/pi-hole/FTL/security/advisories/GHSA-ww5x-xx4x-qvjr) (both **high**, RCE via
`webserver.advancedOpts` / `misc.dnsmasq_lines`) and 8 medium/low FTL rows; 3 stored-XSS rows in Web 6.6.
`podman exec pihole pihole -v` → Core v6.4.3 (**latest v6.5**), Web v6.6 (**latest v6.6.1**),
FTL v6.7.1 (**latest v6.8**); image is `pihole/pihole:latest`, label `2026.09.0` built 2026-09-19.
Rows listed in the working page are the advisories published on/after that build date. Two more
([GHSA-gx63-h4w6-f46g](https://github.com/pi-hole/FTL/security/advisories/GHSA-gx63-h4w6-f46g),
[GHSA-7997-2868-rjfg](https://github.com/pi-hole/FTL/security/advisories/GHSA-7997-2868-rjfg)) were published the same day the image was built.
**Action:** pull the current `pihole` image and pin it (`tag@sha256:…`), which closes the 6.8/6.6.1/6.5 set, then
finish the deferred half of the pass: diff the 13 older FTL advisories (CVE-2026-65963/65964/71304/65966,
CVE-2026-44693, CVE-2026-39849, CVE-2026-35491/35517/35518/35519/35520/35521, CVE-2025-62165 — several
HIGH/RCE-class) and the 21 older Web advisories against the new build.
Source: [vuln-dankclaw.md](https://gitea.franksdank.cloud/dank/command-center/src/branch/main/omp-docs/reports/vuln-dankclaw.md) · audit [fleet-security-audit-2026-10-21.html](https://gitea.franksdank.cloud/dank/command-center/src/branch/main/omp-docs/reports/fleet-security-audit-2026-10-21.html)
---
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
dank
self-assigned this 2026-10-21 15:59:09 -07:00
Taking ownership (agent). Pull + pin the current pihole build (closes the 6.8/6.6.1/6.5 set) in the same digest pass as #70, then diff the deferred older FTL/Web advisories against the new build date.
**Taking ownership (agent).** Pull + pin the current pihole build (closes the 6.8/6.6.1/6.5 set) in the same digest pass as #70, then diff the deferred older FTL/Web advisories against the new build date.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: 1 FTL high (GHSA-2h7g-g549-hf74),
plus GHSA-2794-hrj8-5jg9 and
GHSA-ww5x-xx4x-qvjr (both high, RCE via
webserver.advancedOpts/misc.dnsmasq_lines) and 8 medium/low FTL rows; 3 stored-XSS rows in Web 6.6.podman exec pihole pihole -v→ Core v6.4.3 (latest v6.5), Web v6.6 (latest v6.6.1),FTL v6.7.1 (latest v6.8); image is
pihole/pihole:latest, label2026.09.0built 2026-09-19.Rows listed in the working page are the advisories published on/after that build date. Two more
(GHSA-gx63-h4w6-f46g,
GHSA-7997-2868-rjfg) were published the same day the image was built.
Action: pull the current
piholeimage and pin it (tag@sha256:…), which closes the 6.8/6.6.1/6.5 set, thenfinish the deferred half of the pass: diff the 13 older FTL advisories (CVE-2026-65963/65964/71304/65966,
CVE-2026-44693, CVE-2026-39849, CVE-2026-35491/35517/35518/35519/35520/35521, CVE-2025-62165 — several
HIGH/RCE-class) and the 21 older Web advisories against the new build.
Source: vuln-dankclaw.md · audit fleet-security-audit-2026-10-21.html
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
Taking ownership (agent). Pull + pin the current pihole build (closes the 6.8/6.6.1/6.5 set) in the same digest pass as #70, then diff the deferred older FTL/Web advisories against the new build date.