CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation

ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)

Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities

CedarJava has type confusion vulnerability

seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion

containerd user ID handling bypass allows runAsNonRoot evasion

Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability

async-tar PAX extension-header desync enables tar entry/content smuggling

Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update

LangSmith SDK TracingMiddleware: Arbitrary server-side file read

libxslt Type Confusion vulnerability that affects Nokogiri

free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types

@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input

Access of Resource Using Incompatible Type ('Type Confusion') in yourls/yourls

tar has a PAX header desynchronization issue

astral-tokio-tar has a PAX Header Desynchronization issue

tar-rs incorrectly ignores PAX size headers if header size is nonzero

TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function

astral-tokio-tar is Vulnerable to PAX Header Desynchronization