Vendor
Esri
177 known vulnerabilities.
Esri at a glance
- Last 12 months
- 42
- Critical · all time
- 12
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 9 | 2 |
| Sep 2026 | 1 | 0 |
| Aug 2026 | 13 | 0 |
| Jul 2026 | 4 | 3 |
| Jun 2026 | 0 | 0 |
| May 2026 | 2 | 0 |
| Apr 2026 | 2 | 2 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 1 | 0 |
| Dec 2025 | 10 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 1 | 1 |
| Sep 2025 | 9 | 0 |
| Aug 2025 | 5 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 1 | 1 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 24 | 1 |
| Feb 2025 | 3 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
Latest advisories
-
High max 9.8
ESRI ArcGIS: Mehrere Schwachstelle
Ein Angreifer kann mehrere Schwachstellen in ESRI ArcGIS ausnutzen, um einen SQL-Injection oder Cross Site Scripting Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen und einen Denial of Service zu verursachen.
first Oct 14, 2026 -
High max 9.8
ESRI ArcGIS: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
Ein Angreifer kann mehrere Schwachstellen in ESRI ArcGIS ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
first Sep 27, 2026 -
Medium max 6.1WID-SEC-2026-2966 13 CVEs
ESRI Portal für ArcGIS: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in ESRI Portal für ArcGIS ausnutzen, um Cross-Site-Scripting- und HTML-Injection-Angriffe durchzuführen, die Authentifizierung zu umgehen oder vertrauliche Informationen offenzulegen.
-
High max 9.8WID-SEC-2026-2237 2 CVEs
ESRI ArcGIS: Mehrere Schwachstellen
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ESRI ArcGIS ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder Nutzerrechte zu erlangen.
-
High max 9.8
ESRI ArcGIS: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in ESRI ArcGIS ausnutzen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.
first May 27, 2026
177 results · Feed
-
Medium 6.1
BUG-000187164 - ArcGIS Server has a security vulnerability.
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the…
-
Medium 6.1
BUG-000187165 - ArcGIS Server has a security vulnerability.
There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victi…
-
Medium 5.3
BUG-000182936 - ArcGIS Server has a security vulnerability.
Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, and 11.…
-
High 7.5
BUG-000186514 - ArcGIS Server has a security vulnerability.
There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny serv…
-
Medium 6.1
BUG-000185167 - ArcGIS Server has a security vulnerability.
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the…
-
Critical 9.8
BUG-000187511 - ArcGIS Server has a security vulnerability.
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access …
-
Medium 6.5
Portal for ArcGIS has a security vulnerability
A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the sign…
-
Medium 5.5
BUG-000171040 Portal for ArcGIS has a security vulnerability
A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifie…
-
Critical 9.8
BUG-000187331 Portal for ArcGIS has a security vulnerability
A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
-
High 7.5
Esri Lerc has a security vulnerability
Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pas…
-
Medium 5.5
stored cross site scripting issue in Esri Portal for ArcGIS
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working…
-
Medium 6.1
reflected cross site scripting vulnerability in Esri Portal for ArcGIS
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the…
-
Medium 6.1
stored cross site scripting issue in Esri Portal for ArcGIS
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Ente…
-
Medium 6.1
stored cross site scripting issue in Esri Portal for ArcGIS
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with …
-
Low 3.8
HTML injection vulnerability in Esri Portal for ArcGIS
There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 ar…
-
Medium 5.5
stored cross site scripting issue in Esri Portal for ArcGIS
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with …
-
Medium 5.5
stored cross site scripting issue in Esri Portal for ArcGIS
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with …
-
Medium 5.5
stored cross site scripting issue in Esri Portal for ArcGIS
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working…
-
Medium 5.4
HTML injection vulnerability in Esri Portal for ArcGIS
There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5…
-
Medium 5.3
missing authentication vulnerability in Esri Portal for ArcGIS
There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) that should only be accessible by authenticated users. Users w…
-
Medium 5.9
information disclosure vulnerability in Esri Portal for ArcGIS
There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.
-
Low 3.5
HTML injection vulnerability in Esri Portal for ArcGIS
There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, …
-
Medium 5.9
information disclosure vulnerability in Esri Portal for ArcGIS
There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier that may under difficult to reproduce circumstances allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.
-
Critical 9.8
Missing Authentication
Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be …
-
High 8.1
Weak Password Recovery Mechanism in Portal for ArcGIS
A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. Arc…
-
Critical 9.8
Directory Traversal in ArcGIS Server
Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit this issue by sending crafted path parameters. Successful exploitation could allow overwriting sensitiv…
-
Critical 9.8
Unvalidated File Upload vulnerability in ArcGIS Server.
Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially allowing f…
-
Medium 4.7
Unvalidated Redirect in ArcGIS Server
ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a specially crafted request, Successful exploitation may result in the application redirecting the browser to …
-
Medium 5.3
Improper Authentication issue in ArcGIS Server
ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker could exploit this issue by sending a crafted request to the endpoint. Successful exploitation may result in disruption of …
-
Critical 9.8
Incorrect privilege assignment in Portal for ArcGIS
An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.
-
Critical 9.8
Incorrect privilege assignment in Portal for ArcGIS
An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create developer credentials that may grant more privileges than expected.
-
Medium 5.0
XSS issue is Esri ArcGIS Pro versions 3.6.0 and earlier
There is a Cross‑Site Scripting (XSS) issue in Esri ArcGIS Pro versions 3.6.0 and earlier. ArcGIS Pro is a desktop application, and exploitation is limited to local users interacting with the application; no privileged role or elevated permissions are require…
-
Medium 6.1
Reflected XSS vulnerability in ArcGIS Server.
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victi…
-
Medium 6.1
Stored XSS vulnerability in ArcGIS Server
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victi…
-
Medium 6.1
There is a cross site scripting issue in ArcGIS Server.
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victi…
-
Medium 6.1
Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server.
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victi…
-
Medium 5.6
Unvalidated File Upload vulnerability in ArcGIS Server.
ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories. However, the server’s architecture en…
-
Medium 5.6
Unvalidated File Upload vulnerability in ArcGIS Server.
ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories. However, the server’s architecture en…
-
Medium 6.1
Reflected XSS vulnerability in ArcGIS Server.
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victi…
-
Medium 6.1
Stored XSS vulnerability in ArcGIS Server.
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victi…