EUVD-2026-15588

Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through = 3.7.1...

CVE-2026-25367

Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CitiLights: from n/a through 3.7.2...

Dozens of ICE Vehicles in Minnesota Lack ‘Necessary’ Lights and Sirens

A contract justification published in a federal register on Tuesday says that 31 ICE vehicles operating in the Twin Cities area “lack the necessary emergency lights and sirens” to be “compliant.”...

CVE-2022-23701

A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 iLO 4 firmware versions: Prior to 2.60. This vulnerability could be remotely exploited to allow an attacker to supply invalid input to the iLO 4 webserver, causing it to respond with...

CVE-2022-23704

A potential security vulnerability has been identified in Integrated Lights-Out 4 iLO 4. The vulnerability could allow remote Denial of Service. The vulnerability is resolved in Integrated Lights-Out 4 iLO 4 2.80 and later...

PT-2026-43845

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the greybus lights staging component. The function gb lights light config stores the channel count before the channels array is allocated. If the...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993178)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993178 advisory. In the Linux kernel, the following vulnerability has been resolved: greybus: lights: check return of getchannelfrommode If channel for the given node is not found we...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: My coauthor Nathan E. Sanders and I are speaking at the Rayburn House Office Building in Washington, DC at noon ET on November 17, 2025. The event is hosted by the POPVOX Foundation and the topic is “AI and Congress: Practical Step...

HP Integrated Lights-Out Improper Neutralization of Input During Web Page Generation (CVE-2021-29204)

"A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4 %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid504406; scriptversion"1.1"; scriptsetattributeattribute:"pluginmodificationdate", value:"2025/11/13"; scriptcveid"CVE-2021-29204";...

HP Integrated Lights-Out Improper Input Validation (CVE-2018-7105)

A security vulnerability in HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers prior to v1.35, HPE Integrated Lights-Out 4 iLO 4 prior to v2.61, HPE Integrated Lights-Out 3 iLO 3 prior to v1.90 could be remotely exploited to execute arbitrary code leading to disclosure of information. This...

HP Integrated Lights-Out Improper Neutralization of Input During Web Page Generation (CVE-2021-29211)

"A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4 %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid504424; scriptversion"1.1"; scriptsetattributeattribute:"pluginmodificationdate", value:"2025/11/13"; scriptcveid"CVE-2021-29211";...

HP Integrated Lights-Out Remote Code Execution (CVE-2013-2338)

Unspecified vulnerability on HP Integrated Lights-Out 3 aka iLO3 cards with firmware before 1.57 and 4 aka iLO4 cards with firmware before 1.22, when Single-Sign-On SSO is used, allows remote attackers to execute arbitrary code via unknown vectors. This plugin only works with Tenable.ot. Please...

HP Integrated Lights-Out Denial of Service (CVE-2017-8987)

A Unauthenticated Remote Denial of Service vulnerability was identified in HPE Integrated Lights-Out 3 iLO 3 version v1.88 only. The vulnerability is resolved in iLO3 v1.89 or subsequent versions. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for...

HP Integrated Lights-Out Denial of Service (CVE-2018-7093)

A security vulnerability in HPE Integrated Lights-Out 3 prior to v1.90, iLO 4 prior to v2.60, iLO 5 prior to v1.30, Moonshot Chassis Manager firmware prior to v1.58, and Moonshot Component Pack prior to v2.55 could be remotely exploited to create a denial of service. This plugin only works with...

HP Integrated Lights-Out Improper Neutralization of Input During Web Page Generation (CVE-2021-29207)

"A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4 %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid504392; scriptversion"1.1"; scriptsetattributeattribute:"pluginmodificationdate", value:"2025/11/13"; scriptcveid"CVE-2021-29207";...

HP Integrated Lights-Out Improper Input Validation (CVE-2022-28634)

A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. A highly privileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and...

HP Integrated Lights-Out Denial of Service (CVE-2015-5435)

Unspecified vulnerability in HP Integrated Lights-Out iLO firmware 3 before 1.85 and 4 before 2.22 allows remote authenticated users to cause a denial of service via unknown vectors. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

HP Integrated Lights-Out Improper Neutralization of Input During Web Page Generation (CVE-2021-46846)

Cross Site Scripting vulnerability in Hewlett Packard Enterprise Integrated Lights-Out 5. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid504393;...

HP Integrated Lights-Out Improper Input Validation (CVE-2017-8979)

Security vulnerabilities in the HPE Integrated Lights-Out 2 iLO 2 firmware could be exploited remotely to allow authentication bypass, code execution, and denial of service. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

HP Integrated Lights-Out Improper Input Validation (CVE-2022-28626)

A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. A highly privileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and...