CVE-2026-20587 is a type confusion vulnerability in MediaTek chipsets that may allow local escalation of privilege. Exploitation does not require user interaction but requires the attacker to already have System privilege. The vulnerability affects multiple MediaTek chipset models and has a medium severity rating with a CVSS score of 6.7.
CVE-2026-104846 is a critical type confusion vulnerability in the lxsmnsyc seroval library affecting versions from 0.12.0 up to but not including 1.6.2. The flaw allows attacker-controlled JSON to trigger unexpected code execution via deserialization of a fulfilled Promise control node, bypassing previous remediation attempts. This issue is fixed in version 1.6.2.
CVE-2026-47583 is a type confusion vulnerability in the NVIDIA GeForce GPU Display Driver for Windows kernel module. Exploitation could allow an attacker with local low privileges to execute code, cause denial of service, escalate privileges, disclose information, or tamper with data. The vulnerability has a high severity with a CVSS score of 7.8. No affected versions or patch information are provided in the available data.
CVE-2026-47572 is a high-severity vulnerability in the NVIDIA GeForce GPU Display Driver for Linux. It involves a type confusion flaw in the kernel mode layer that could allow a local user with limited privileges to cause code execution, denial of service, privilege escalation, information disclosure, and data tampering.
CVE-2026-47569 is a type confusion vulnerability in the NVIDIA GeForce GPU Display Driver for Linux kernel mode layer. It arises from a handle recycle race condition. Exploitation could allow an attacker with limited privileges to execute code, cause denial of service, escalate privileges, disclose information, or tamper with data.
CVE-2026-47504 is a high-severity vulnerability in the NVIDIA Linux GPU Display Driver's NGX updater component. It involves a type confusion flaw in an outdated embedded cryptographic library. Exploitation could allow an attacker with local privileges to execute code, cause denial of service, disclose information, or tamper with data.
CVE-2026-102757 is a high-severity vulnerability in the Eclipse Foundation's ThreadX real-time operating system. It allows an unprivileged, memory-protected module to manipulate kernel memory in privileged mode, bypassing isolation boundaries by clearing the MPU enable bit. This occurs due to improper validation in the Module Manager's object dereference logic, enabling an attacker to craft addresses that pass checks incorrectly and gain privileged memory access.
The ip-address JavaScript library versions prior to 10.7.1 contain a vulnerability in the isInSubnet and isHostInSubnet methods. These methods perform subnet containment checks by comparing masked binary strings without verifying that both addresses belong to the same IP family (IPv4 vs IPv6). This flaw can cause cross-family containment checks to incorrectly classify an IP address as within a subnet when it is not, potentially leading to incorrect allowlist or denylist decisions. The issue is fixed in version 10.7.1.
CVE-2026-88816 is a high-severity vulnerability in Perl's DBI module versions before 1.654. It involves a type confusion issue where numeric values are incorrectly treated as strings in the FetchHashKeyName attribute. This leads to a segmentation fault when fetchrow_hashref attempts to use an invalid pointer as a hash key name. The flaw can be triggered by setting FetchHashKeyName to a numeric value such as an integer or floating-point number.
CVE-2026-85644 is a type confusion vulnerability in XS::Parse::Infix versions 0.40 through 0.49 for Perl. The vulnerability arises because the wrapper function incorrectly checks argument types, leading to dereferencing invalid memory and causing a segmentation fault. This can be triggered by supplying crafted input, such as a number treated as an array reference, potentially allowing an attacker to control memory dereferencing.
CVE-2026-88815 is a type confusion vulnerability in Perl's DBI module versions before 1.654. It occurs when numeric values are incorrectly treated as strings during SQL type casting, leading to a segmentation fault. This flaw arises because the function sql_type_cast_svpv passes a string pointer without proper stringification, causing invalid memory access. The vulnerability can be triggered by calling sql_type_cast with a numeric value and SQL_NUMERIC type.
CVE-2026-97737 is a high-severity vulnerability in Wakapi before version 2.17.6. It involves a type confusion issue in the user caching service that allows a lookup to be resolved in an unintended context. This flaw can lead to account takeover by unauthorized users.
CVE-2026-96883 is a high-severity type confusion vulnerability in AWS pgcollection versions 2.0.0 through 2.1.1. This flaw allows an authenticated remote user to execute arbitrary code as the postgres operating system user by exploiting mismatched type metadata in collection value retrieval and array conversion functions. The issue is resolved in version 2.1.2 and later.
CVE-2026-18458 is a medium severity vulnerability in RTI Connext Professional Core Libraries involving out-of-bounds read, incorrect function call arguments, and type confusion. It affects versions 6.1.2.21, 7.3.0 up to but not including 7.3.1.6, and 7.4.0 up to but not including 7.7.0.1. The flaw allows overreading buffers, potentially leading to unauthorized data access or application instability.
CVE-2026-11389 is a medium severity vulnerability in RTI Connext Professional Core Libraries that involves an out-of-bounds read due to function calls with incorrect argument counts and type confusion. It affects versions from 7.4.0 up to but not including 7.7.0.1, and from 7.3.0 up to but not including 7.3.1.6. This vulnerability can cause buffer overread conditions.
Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins/out_forward/forward.c secure_forward_pong copies the server-controlled PONG[2] reason into the 32-byte stack buffer msg with memcpy without checking its MessagePack type or length. An attacker who controls or can impersonate an out_forward Secure Forward destination configured with Shared_Key or Empty_Shared_Key can send an oversized reason during the first handshake and overwrite stack control data. Protected builds reliably terminate, while builds without a stack canary or with a disclosure can allow remote code execution as the Fluent Bit process user. When the opt-in --supervisor mode is used, fork-only respawns preserve the canary and address layout, allowing repeated crash-or-survive probes to support code execution on a hardened build; ordinary exec-based or service-manager restarts do not preserve that state. This issue is fixed in version 5.0.8.
CVE-2026-94083 is a critical type confusion vulnerability in Suricata before version 8.0.7. It occurs in the handling of DNS over HTTPS version 2 (DoH2) requests when the HTTP1 to HTTP2 upgrade is involved, causing cleanup code for HTTP2 state to run incorrectly on HTTP1 state. This can lead to an invalid free operation, potentially causing a denial of service. The vulnerability requires the app-layer.protocols.doh2 feature to be enabled, which is the default in Suricata 8.x versions.
CVE-2026-45764 is a critical vulnerability in Suricata, a network intrusion detection and prevention system. The flaw involves a type confusion issue triggered by a protocol change while processing HTTP/2 traffic. This can cause Suricata to crash, resulting in a denial of service. Versions prior to 7.0.16 and 8.0.5 are affected. Fixed versions 7.0.16 and 8.0.5 address this issue. Disabling HTTP/2 parsing is a recommended workaround if that functionality is not needed.
CVE-2026-45762 is a high-severity vulnerability in Suricata, a network intrusion detection and prevention system. The flaw involves a type confusion in the IP defragmentation tracker lookup, where fragmented IPv6 packets could be incorrectly associated with IPv4 trackers. This mismatch can cause Suricata to crash and result in a denial of service. The issue affects Suricata versions prior to 7.0.16 and versions from 8.0.0 up to but not including 8.0.5. Fixed versions 7.0.16 and 8.0.5 address this vulnerability. A workaround for IDS deployments using AF_PACKET is to enable the AF_PACKET defrag option to prevent Suricata from processing problematic fragmented packets.