Esri

Latest CVEs · RSS

• CVE-2026-69226 2026-10-13 · CVSS 6.5
  A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disa
• CVE-2026-10759 2026-10-13 · CVSS 5.5
  A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without suff
• CVE-2026-69227 2026-10-13 · CVSS 9.8
  A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attack
• CVE-2026-10758 2026-09-25 · CVSS 7.5
  Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer O
• CVE-2026-69233 2026-08-21 · CVSS 5.5
  There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to
• CVE-2026-69234 2026-08-21 · CVSS 6.1
  There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to
• CVE-2026-69235 2026-08-21 · CVSS 6.1
  There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious
• CVE-2026-69236 2026-08-21 · CVSS 6.1
  There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious
• CVE-2026-69237 2026-08-21 · CVSS 3.8
  There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to inser
• CVE-2026-69232 2026-08-21 · CVSS 5.5
  There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious
• CVE-2026-69231 2026-08-21 · CVSS 5.5
  There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious
• CVE-2026-69230 2026-08-21 · CVSS 5.5
  There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to
• CVE-2026-69229 2026-08-21 · CVSS 5.4
  There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML
• CVE-2026-69228 2026-08-21 · CVSS 5.3
  There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a
• CVE-2026-69225 2026-08-21 · CVSS 5.9
  There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attac
• CVE-2026-69238 2026-08-21 · CVSS 3.5
  There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary
• CVE-2026-69224 2026-08-21 · CVSS 5.9
  There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier that may under difficult to reproduce circumstances allow a
• CVE-2026-13019 2026-07-07 · CVSS 9.8
  Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a rem
• CVE-2026-13020 2026-07-07 · CVSS 8.1
  A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote,
• CVE-2026-9181 2026-07-06 · CVSS 9.8
  Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit this
• CVE-2026-9182 2026-07-06 · CVSS 9.8
  Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the a
• CVE-2026-2813 2026-05-20 · CVSS 4.7
  ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a specially
• CVE-2026-2812 2026-05-20 · CVSS 5.3
  ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker could exploit this issue
• CVE-2026-33519 2026-04-21 · CVSS 9.8
  An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check perm
• CVE-2026-33518 2026-04-21 · CVSS 9.8
  An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create develop