CWE-843: Type Confusion vulnerabilities

CVE-2026-59304 is a type confusion vulnerability in Spring Cloud Stream related to improper caching of the original content type in the Avro component. It affects multiple versions of Spring Cloud Stream including 4.2.0 through 4.2.6, 4.3.0 through 4.3.3, and 5.0.0 through 5.0.2. The vulnerability has a low CVSS score of 3.1, indicating limited impact. No official patch or remediation level has been provided yet, and there are no known exploits in the wild.

CVE-2026-80183 is a high-severity vulnerability in OpenStack Keystone before version 29.0.3. It allows any authenticated user with the role 'reader' on any project to list all project-scoped role assignments under any domain by exploiting a logic flaw in the domain ID check. This leads to unauthorized disclosure of names and home-domain IDs of users, groups, projects, and roles across the cloud deployment. The issue arises from misuse of a null domain_id value in the role assignment listing function, enabling attackers to map role assignments cloud-wide.

Missing queue-set type validation in xQueueAddToSet() in the FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports with configUSE_QUEUE_SETS=1 to read privileged kernel memory. To remediate this issue, users should upgrade to version 11.3.1 or later.

CVE-2026-16919 is a critical vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves improper validation of network-supplied pointers leading to type confusion (CWE-843). This flaw could allow a remote attacker to execute arbitrary code without requiring privileges or user interaction.

A reachable assertion vulnerability in ZcashFoundation's Zebra node prior to version 4.5.0 allows an unauthenticated IPv4 peer to deterministically crash a synced node. This occurs due to an address mismatch assertion triggered during mempool misbehavior handling after a P2P handshake with an invalid mempool transaction. The issue is fixed in version 4.5.0.

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service.

Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Access of resource using incompatible type ('type confusion') in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint.

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVE-2026-13066 is a high-severity vulnerability in MongoDB Server involving improper handling of DBPointer objects during BSON serialization in the server-side JavaScript engine. This flaw can cause internal process memory contents to be unintentionally included in data returned to clients, leading to information disclosure. The issue affects deployments that use server-side JavaScript. No official patch or remediation guidance is currently provided by the vendor.

Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not. This issue affects Apache Fory C++: from 0.14.0 before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Access of resource using incompatible type ('type confusion') in Windows DWM allows an authorized attacker to elevate privileges locally.

Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.