| CVE-2026-106465 |
Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server
|
6.9
Medium
|
Oct 14, 2026 |
| CVE-2026-106464 |
Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing
|
8.7
High
|
Oct 14, 2026 |
| CVE-2026-103415 |
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without…
|
9.3
Critical
|
Oct 14, 2026 |
| CVE-2026-102717 |
MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
|
7.5
High
|
Sep 30, 2026 |
| CVE-2026-102727 |
FTP Passive Data Connection Not Bound to the Authenticated Control Peer
|
6.0
Medium
|
Sep 29, 2026 |
| CVE-2026-102728 |
Out-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)
|
6.3
Medium
|
Sep 29, 2026 |
| CVE-2026-102726 |
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
|
7.1
High
|
Sep 29, 2026 |
| CVE-2026-102725 |
Out-of-bounds Read from Unvalidated MSRP Attribute List Length
|
7.1
High
|
Sep 29, 2026 |
| CVE-2026-102724 |
NULL pointer dereference when evicting the last MSRP attribute in a participant's list
|
7.1
High
|
Sep 29, 2026 |
| CVE-2026-102723 |
NULL Pointer Dereference on MSRP Attribute Table Exhaustion
|
7.1
High
|
Sep 29, 2026 |
| CVE-2026-102722 |
The FTP client trusts arbitrary IP addresses in the PASV server response
|
6.9
Medium
|
Sep 29, 2026 |
| CVE-2026-102721 |
TFTP client and server copy the ERROR packet message without bounding the read against the packet
|
6.9
Medium
|
Sep 29, 2026 |
| CVE-2026-102718 |
Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length
|
8.7
High
|
Sep 29, 2026 |
| CVE-2026-102714 |
ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanent loop
|
7.1
High
|
Sep 29, 2026 |
| CVE-2026-102713 |
Unbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stall
|
8.3
High
|
Sep 29, 2026 |
| CVE-2026-102712 |
Out-of-bounds read in the NetX Secure DTLS ClientHello parser
|
6.3
Medium
|
Sep 29, 2026 |
| CVE-2026-102762 |
The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message
|
8.2
High
|
Sep 29, 2026 |
| CVE-2026-102761 |
NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained…
|
9.3
Critical
|
Sep 29, 2026 |
| CVE-2026-102760 |
When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has…
|
8.3
High
|
Sep 29, 2026 |
| CVE-2026-102759 |
NetX Secure TLS accepts an empty application-data record without verifying its message authentication code
|
6.3
Medium
|
Sep 29, 2026 |
| CVE-2026-102758 |
The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data
|
7.5
High
|
Sep 29, 2026 |
| CVE-2025-55085 |
In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the…
|
8.8
High
|
Oct 17, 2025 |
| CVE-2025-55096 |
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read…
|
2.1
Low
|
Oct 17, 2025 |
| CVE-2025-55094 |
In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of…
|
6.9
Medium
|
Oct 17, 2025 |
| CVE-2025-55093 |
In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of…
|
6.9
Medium
|
Oct 17, 2025 |