rootpwn

high · CVSS v3 8.2

CVE-2026-83946

CVE-2026-83946 is a cross-site scripting vulnerability in Microsoft Azure Portal caused by insufficient input neutralization during web page

Overview

CVE-2026-83946 is a cross-site scripting vulnerability in Microsoft Azure Portal caused by insufficient input neutralization during web page generation. It can allow an unauthorized attacker to spoof portal content over a network. It matters because Azure Portal is a privileged management interface for cloud resources.

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network.

Impact

The vulnerability primarily affects integrity and confidentiality by enabling spoofed portal content that may mislead users into performing unintended actions or disclosing sensitive information.

Affected products

  • Microsoft Azure Portal
  • Microsoft Azure

Scores

Severity
high
CVSS v2
8.5
CVSS v3
8.2
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-85887

CVE-2026-85887 is a high-severity permission misconfiguration in Microsoft 365 Copilot. It can allow an authorized attacker to disclose information over a network. It matters because it may expose sensitive tenant or user data if Copilot resources are over-permissioned.

View analysis

high

CVE-2026-93450

The go-openapi/swag jsonutils library (v0.27.0 and earlier) has a stack‑overflow flaw when parsing deeply nested JSON. Attackers can send malformed OpenAPI specs to any service that uses this library, causing the process to crash and all current requests to fail.

View analysis

high

CVE-2026-93452

snappy-java 1.1.10.8 has a buffer overflow in Snappy.compress(ByteBuffer, ByteBuffer) that can corrupt off‑heap memory and crash the JVM. The flaw is triggered by incompressible data that exceeds the destination buffer’s remaining capacity. It can cause application downtime in any Java process using the affected library.

View analysis

high

CVE-2026-93203

A race condition in the batman-adv kernel module can corrupt the CRC used to validate claim frames, leading to incorrect routing information in mesh networks. The flaw may cause routing tables to become inconsistent, potentially disrupting network connectivity.

View analysis