In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply

A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram

Potential out of bound read in _nx_ip_packet_receive()

Potential out of bound read issue in _nx_ipv4_packet_receive() in NetX Duo

NetX Secure TLS accepts an empty application-data record without verifying its message authentication code

Inadequate bounds check and potential underflow in _ux_host_class_hid_report_descriptor_get()

FTP Passive Data Connection Not Bound to the Authenticated Control Peer

Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read

Out-of-bounds Read from Unvalidated MSRP Attribute List Length

NULL Pointer Dereference When Evicting the Sole MSRP Attribute

NULL Pointer Dereference on MSRP Attribute Table Exhaustion

Out of bound read and write in _nx_ipv4_packet_receive() when handling unicast DHCP messages

Potential out of bound read in _nx_ipv4_option_process()

Out of bound read in _nx_secure_tls_proc_clienthello_supported_versions_extension()

Broken bounds check in Broken bounds check in _nx_secure_tls_process_clienthello_psk_extension()

Potential out of bound read and info leak in_nx_secure_tls_psk_identity_find()