Total
1014 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-100793 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | N/A | 6.5 MEDIUM |
| JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | |||||
| CVE-2026-69880 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2026-10-19 | N/A | 7.8 HIGH |
| Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-109720 | 2026-10-19 | N/A | 7.1 HIGH | ||
| JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | |||||
| CVE-2025-59233 | 1 Microsoft | 5 365 Apps, Excel, Office and 2 more | 2026-10-18 | N/A | 7.8 HIGH |
| Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | |||||
| CVE-2025-11731 | 2026-10-18 | N/A | 3.1 LOW | ||
| A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service. | |||||
| CVE-2025-43355 | 1 Apple | 6 Ipados, Iphone Os, Macos and 3 more | 2026-10-18 | N/A | 5.5 MEDIUM |
| A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An app may be able to cause a denial-of-service. | |||||
| CVE-2025-59231 | 1 Microsoft | 5 365 Apps, Excel, Office and 2 more | 2026-10-18 | N/A | 7.8 HIGH |
| Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | |||||
| CVE-2025-8354 | 1 Autodesk | 1 Revit | 2026-10-18 | N/A | 7.8 HIGH |
| A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Type Confusion vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | |||||
| CVE-2025-47151 | 1 Entrouvert | 1 Lasso | 2026-10-18 | N/A | 9.8 CRITICAL |
| A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code execution. An attacker can send a malformed SAML response to trigger this vulnerability. | |||||
| CVE-2025-64314 | 1 Huawei | 1 Harmonyos | 2026-10-18 | N/A | 9.3 CRITICAL |
| Permission control vulnerability in the memory management module. Impact: Successful exploitation of this vulnerability may affect confidentiality. | |||||
| CVE-2026-96921 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-16 | N/A | 5.5 MEDIUM |
| Access of resource using incompatible type ('type confusion') in Windows Message Queuing Queue Manager allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-108952 | 2026-10-16 | N/A | 4.6 MEDIUM | ||
| RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rt_free() on close, causing denial of service. | |||||
| CVE-2026-70017 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2026-10-16 | N/A | 5.5 MEDIUM |
| Access of resource using incompatible type ('type confusion') in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-85377 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-16 | N/A | 7.8 HIGH |
| Access of resource using incompatible type ('type confusion') in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69926 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2026-10-16 | N/A | 7.8 HIGH |
| Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-83642 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-16 | N/A | 8.8 HIGH |
| Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-70167 | 1 Microsoft | 2 Windows Server 2022, Windows Server 2025 | 2026-10-16 | N/A | 8.8 HIGH |
| Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network. | |||||
| CVE-2026-109733 | 2026-10-15 | N/A | 8.1 HIGH | ||
| JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | |||||
| CVE-2026-0314 | 2026-10-15 | N/A | N/A | ||
| A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition. The GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome OS is not affected by this vulnerability. | |||||
| CVE-2026-109282 | 2026-10-15 | N/A | 2.5 LOW | ||
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who can cause such an image write can trigger a SIGABRT or SIGSEGV, crashing the process and causing denial of service. | |||||