CVE-2026-44887

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's web-based configuration editor allows arbitrary Python code to be injected into pialert.conf. Since the background scan daemon loads this file via Python's exec(), injected code executes as the daemon process. With web protection disabled (the default configuration), no authentication is required, making this an unauthenticated Remote Code Execution vulnerability. This vulnerability is fixed in 2026-05-07.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: May 27, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-448889.8Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's SaveConfigFile() endpoint writes use CVE-2026-448896.1WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is CVE-2026-44898.8A vulnerability was detected in Tenda A18 Pro 02.03.02.28. This vulnerability affects the function form_fast_setting_wifi_set of the file /g CVE-2026-448907.5Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Fin CVE-2026-448917.5Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.CVE-2026-448927.5Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configu CVE-2026-448937.5Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.F CVE-2026-448947.5Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used when t CVE-2026-448959.2GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships with no authenticat CVE-2026-448966.1Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the render_figure(CVE-2026-448976.1Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading() builds the opening <hN> tag by string CVE-2026-448986.1Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_toc_ul() builds a <ul> table-of-contents tree from a