Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

CVEs (904)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-4078 2Debian Google 2Chrome Debian Linux Jun 17, 2026 Dec 23, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Type confusion in V8 in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-4061 3Debian FedoraprojectGoogle 3Chrome Debian LinuxFedora Jun 17, 2026 Dec 23, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Type confusion in V8 in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-4056 3Debian FedoraprojectGoogle 3Chrome Debian LinuxFedora Jun 17, 2026 Dec 23, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Type confusion in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-38012 3Debian FedoraprojectGoogle 3Chrome Debian LinuxFedora Jun 17, 2026 Dec 23, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-38007 3Debian FedoraprojectGoogle 3Chrome Debian LinuxFedora Jun 17, 2026 Dec 23, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-24045 1Facebook 1Hermes Jun 17, 2026 Dec 13, 2021 N/A· v4 9.8 CRITICAL· v3 6.8 MEDIUM· v2 A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploitable if the application using Hermes permits evaluation of u...Show more A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.Show less
CVE-2021-38001 3Debian FedoraprojectGoogle 3Chrome Debian LinuxFedora Jun 17, 2026 Nov 23, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Type confusion in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-41190 2Fedoraproject Linuxfoundation 3Fedora Open Container Initiative Distribution SpecificationOpen Container Initiative Image Format Specification Jun 17, 2026 Nov 17, 2021 N/A· v4 5.0 MEDIUM· v3 4.0 MEDIUM· v2 The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used t...Show more The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.Show less
CVE-2021-40872 1Softing 2Smartlink Hw Dp Uatoolkit Embedded Jun 17, 2026 Nov 10, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in Softing Industrial Automation uaToolkit Embedded before 1.40. Remote attackers to cause a denial of service (DoS) or login as an anonymous user (bypassing security checks) by sending crafted me...Show more An issue was discovered in Softing Industrial Automation uaToolkit Embedded before 1.40. Remote attackers to cause a denial of service (DoS) or login as an anonymous user (bypassing security checks) by sending crafted messages to a OPC/UA server. The server process may crash unexpectedly because of an invalid type cast, and must be restarted.Show less
CVE-2021-40871 1Softing 4Datafeed Opc Suite OpcSecure Integration Server+1 more Jun 17, 2026 Nov 10, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in Softing Industrial Automation OPC UA C++ SDK before 5.66. Remote attackers to cause a denial of service (DoS) by sending crafted messages to a OPC/UA client. The client process may crash unexpe...Show more An issue was discovered in Softing Industrial Automation OPC UA C++ SDK before 5.66. Remote attackers to cause a denial of service (DoS) by sending crafted messages to a OPC/UA client. The client process may crash unexpectedly because of a wrong type cast, and must be restarted.Show less
CVE-2021-31344 1Siemens 11Apogee Modular Building Controller Firmware Apogee Modular Equiment Controller FirmwareApogee Pxc Compact Firmware+8 more Jun 17, 2026 Nov 9, 2021 6.9 MEDIUM· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions...Show more A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). ICMP echo packets with fake IP options allow sending ICMP echo reply messages to arbitrary hosts on the network. (FSMD-2021-0004)Show less
CVE-2021-23820 1Manuelstofer 1Json Pointer Jun 17, 2026 Nov 3, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays.
CVE-2021-23807 1Janl 1Jsonpointer Jun 17, 2026 Nov 3, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.
CVE-2021-23624 1Dotty Project 1Dotty Jun 17, 2026 Nov 3, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays.
CVE-2021-23509 1Json Ptr Project 1Json Ptr Jun 17, 2026 Nov 3, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.
CVE-2021-23472 1Bootstrap Table 1Bootstrap Table Jun 17, 2026 Nov 3, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a strin...Show more This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.Show less
CVE-2018-6122 1Google 1Chrome Jun 17, 2026 Nov 2, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Type confusion in WebAssembly in Google Chrome prior to 66.0.3359.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-30818 1Apple 6Ipados Iphone OsMacos+3 more Jun 17, 2026 Oct 28, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, Safari 15, watchOS 8. Processing maliciously crafted web content may lead...Show more A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, Safari 15, watchOS 8. Processing maliciously crafted web content may lead to arbitrary code execution.Show less
CVE-2021-30627 2Fedoraproject Google 2Chrome Fedora Jun 17, 2026 Oct 8, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Type confusion in Blink layout in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-23447 1Teddy Project 1Teddy Jun 17, 2026 Oct 7, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array (instead of a string).

Previous 1...303132...46 Next