CVEs we hold for Esri

Records whose assigning authority named Esri as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-9182Unvalidated File Upload vulnerability in ArcGIS Server.Esri ArcGIS Server

CVE-2026-9181Directory Traversal in ArcGIS ServerEsri ArcGIS Server

CVE-2026-69238HTML injection vulnerability in Esri Portal for ArcGISEsri Portal for ArcGIS

CVE-2026-69237HTML injection vulnerability in Esri Portal for ArcGISEsri Portal for ArcGIS

CVE-2026-69236stored cross site scripting issue in Esri Portal for ArcGISEsri Portal for ArcGIS

CVE-2026-69235stored cross site scripting issue in Esri Portal for ArcGISEsri Portal for ArcGIS

CVE-2026-69234reflected cross site scripting vulnerability in Esri Portal for ArcGISEsri Portal for ArcGIS

CVE-2026-69233stored cross site scripting issue in Esri Portal for ArcGISEsri Portal for ArcGIS

CVE-2026-69232stored cross site scripting issue in Esri Portal for ArcGISEsri Portal for ArcGIS

CVE-2026-69231stored cross site scripting issue in Esri Portal for ArcGISEsri Portal for ArcGIS

CVE-2026-69230stored cross site scripting issue in Esri Portal for ArcGISEsri Portal for ArcGIS

CVE-2026-69229HTML injection vulnerability in Esri Portal for ArcGISEsri Portal for ArcGIS

CVE-2026-69228missing authentication vulnerability in Esri Portal for ArcGISEsri Portal for ArcGIS

CVE-2026-69225information disclosure vulnerability in Esri Portal for ArcGISEsri Portal for ArcGIS

CVE-2026-69224information disclosure vulnerability in Esri Portal for ArcGISEsri Portal for ArcGIS

CVE-2026-33519Incorrect privilege assignment in Portal for ArcGISEsri Portal for ArcGIS

CVE-2026-33518Incorrect privilege assignment in Portal for ArcGISEsri Portal for ArcGIS

CVE-2026-2813Unvalidated Redirect in ArcGIS ServerEsri ArcGIS Server

CVE-2026-2812Improper Authentication issue in ArcGIS ServerEsri ArcGIS Server

CVE-2026-1446XSS issue is Esri ArcGIS Pro versions 3.6.0 and earlierEsri ArcGIS Pro

CVE-2026-13020Weak Password Recovery Mechanism in Portal for ArcGISEsri Portal for ArcGIS

CVE-2026-13019Missing AuthenticationEsri Portal for ArcGIS

CVE-2025-67712HTML injection issue in ArcGIS Web App BuilderEsri ArcGIS Web AppBuilder {Developer Edition)

CVE-2025-67711Reflected XSS vulnerability in ArcGIS Server.Esri ArcGIS Server

CVE-2025-67710Stored XSS vulnerability in ArcGIS ServerEsri ArcGIS Server

CVE-2025-67709There is a cross site scripting issue in ArcGIS Server.Esri ArcGIS Server

CVE-2025-67708Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server.Esri ArcGIS Server

CVE-2025-67707Unvalidated File Upload vulnerability in ArcGIS Server.Esri ArcGIS Server

CVE-2025-67706Unvalidated File Upload vulnerability in ArcGIS Server.Esri ArcGIS Server

CVE-2025-67705Reflected XSS vulnerability in ArcGIS Server.Esri ArcGIS Server

CVE-2025-67704Stored XSS vulnerability in ArcGIS Server.Esri ArcGIS Server

CVE-2025-67703Stored XSS vulnerability in ArcGIS Server.Esri ArcGIS Server

CVE-2025-57879BUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS.Esri Portal for ArcGIS

CVE-2025-57878BUG-000174149 - The Portal for ArcGIS has an unvalidated redirect.Esri Portal for ArcGIS

CVE-2025-57877Reflected XSS vulnerability in Portal for ArcGIS.Esri Portal for ArcGIS

CVE-2025-57876Stored XSS vulnerability in Portal for ArcGISEsri Portal for ArcGIS

CVE-2025-57875BUG-000164122 - Reflected XSS vulnerability in Portal for ArcGIS.Esri Portal for ArcGIS

CVE-2025-57874BUG-000161627 - Reflected XSS vulnerability in Portal for ArcGIS. (11.3, 11.1, 10.9.1)Esri Portal for ArcGIS

CVE-2025-57873BUG-000175222 - Reflected XSS vulnerability in Portal for ArcGIS.Esri Portal for ArcGIS

CVE-2025-57872BUG-000174150 - Unvalidated redirect in Portal for ArcGIS.Esri Portal for ArcGIS

CVE-2025-57871BUG-000174020 - Reflected XSS vulnerability identified in Portal for ArcGIS. (11.3, 11.1, 10.9.1)Esri Portal for ArcGIS

CVE-2025-57870BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.Esri ArcGIS Server

CVE-2025-55107BUG-000177335 ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.Esri Portal for ArcGIS Enterprise Sites

CVE-2025-55106BUG-000173171 ArcGIS Enterprise Sites has a Cross-site Scripting vulnerability.Esri Portal for ArcGIS Enterprise Sites

CVE-2025-55105BUG-000177336 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.Esri Portal for ArcGIS Enterprise Experience Sites

CVE-2025-55104BUG-000173918 - ArcGIS Enterprise Sites has a security vulnerability.Esri Portal for ArcGIS Enterprise Sites

CVE-2025-55103BUG-000177333 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.Esri Portal for ArcGIS Enterprise Sites

CVE-2025-4967Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGISEsri Portal for ArcGIS

CVE-2025-2538BUG-000174336Esri Portal for ArcGIS

CVE-2025-1726[#BUG-000172669 ArcGIS Monitor has a security vulnerability]Esri ArcGIS Monitor

CVE-2025-1068There is a code injection vulnerability in Esri ArcGIS AllSourceEsri ArcGIS AllSource

CVE-2025-1067There is a code injection vulnerability in ArcGIS ProEsri ArcGIS Pro

CVE-2024-8149BUG-000168624 - Unvalidated redirect in Portal for ArcGIS.Esri Portal for ArcGIS

CVE-2024-8148BUG-000168624 - Unvalidated redirect in Portal for ArcGIS. (11.2, 11.1, 10.9.1. and 10.8.1)Esri Portal for ArcGIS

CVE-2024-5888Stored XSS in Rest Services API for a Toolbox published as GP ServiceEsri ArcGIS Server

CVE-2024-51966Directory traversal vulnerability in ArcGIS ServerEsri ArcGIS Server

CVE-2024-51963Stored XSS in ArcGIS Server ManagerEsri ArcGIS Server

CVE-2024-51962SQL injection vulnerability in ArcGIS ServerEsri ArcGIS Server

CVE-2024-51961Local file inclusion (LFI) vulnerability in ArcGIS ServerEsri ArcGIS Server

CVE-2024-51960Stored XSS in ArcGIS Server Administrator DirectoryEsri ArcGIS Server

CVE-2024-51959Stored XSS issue in Server Admin APIEsri ArcGIS Server

CVE-2024-51958Directory traversal vulnerability in the admin api for service thumbnailsEsri ArcGIS Server

CVE-2024-51957Stored XSS vulnerability in ArcGIS Rest Services DirectoryEsri ArcGIS Server

CVE-2024-51956Stored XSS vulnerability in ArcGIS Server Administrator DirectoryEsri ArcGIS Server

CVE-2024-51954Unauthorized access to secure services in ArcGIS ServerEsri ArcGIS Server

CVE-2024-51953Stored XSS in ArcGIS Server Rest servicesEsri ArcGIS Server

CVE-2024-51952Stored XSS issue in ArcGIS ServerEsri ArcGIS Server

CVE-2024-51951Stored XSS in Server Admin APIEsri ArcGIS Server

CVE-2024-51950Stored XSS in Server Admin under Services > lifecycleinfosEsri ArcGIS Server

CVE-2024-51949Stored XSS vulnerability in Rest Services under OGCFeature Service and Map ServiceEsri ArcGIS Server

CVE-2024-51948Stored XSS vulnerability in Rest Services under Job IDEsri ArcGIS Server

CVE-2024-51947Stored XSS vulnerability in Rest Services under Layer nameEsri ArcGIS Server

CVE-2024-51946Stored XSS in Rest Services Directory under Identify operationEsri ArcGIS Server

CVE-2024-51945Stored XSS issues in Server Admin APIEsri ArcGIS Server

CVE-2024-51944Stored XSS in Rest Services DirectoryEsri ArcGIS Server

CVE-2024-51942Stored XSS vulnerability in Rest Admin API under Hosted Feature Services pageEsri ArcGIS Server

CVE-2024-38040BUG-000167984 - Portal for ArcGIS has a Local file inclusion (LFI) vulnerabilityEsri Portal for ArcGIS

CVE-2024-38039BUG-000161683 - HTML injection vulnerability in Portal for ArcGIS.Esri Portal for ArcGIS

CVE-2024-38038BUG-000165732 - Reflected XSS in Portal for ArcGISEsri Portal for ArcGIS

CVE-2024-38037BUG-000167983 - Unvalidated redirect in Portal for ArcGISEsri Portal for ArcGIS

CVE-2024-38036BUG-000154827 - Reflected XSS in ArcGIS Experience BuilderEsri Portal for ArcGIS Enterprise Experience Builder

CVE-2024-25709Self-XSS style in move item dialogEsri Portal for ArcGIS

CVE-2024-25708Persistent XSS when creating new application using Web App BuilderEsri ArcGIS Enterprise Web App Builder

CVE-2024-25707BUG-000160241 - Reflected XSS in Portal for ArcGISEsri Portal for ArcGIS

CVE-2024-25706HTMLi at createFolder Content InjectionEsri Portal for ArcGIS

CVE-2024-25705Cross site scripting issue in embed widgetEsri Portal for ArcGIS

CVE-2024-25702BUG-000160599 - Stored XSS in Portal for ArcGIS Web App BuilderEsri ArcGIS Enterprise Web App Builder

CVE-2024-25701BUG-000160765 - Stored XSS in ArcGIS Experience BuilderEsri Portal for ArcGIS Enterprise Experience Builder

CVE-2024-25700Persistent XSS in URL added to a shared mapEsri ArcGIS Enterprise Builder

CVE-2024-25699Portal for ArcGIS has an invalid authentication vulnerabilityEsri Portal for ArcGIS

CVE-2024-25698Reflected XSS in Portal for ArcGISEsri Portal for ArcGIS

CVE-2024-25697Stored XSS in Portal for ArcGISEsri Portal for ArcGIS

CVE-2024-25696Stored XSS in Portal for ArcGISEsri Portal for ArcGIS

CVE-2024-25695concatenated errors resulting in cross site scripting and frame injection issues.Esri Portal for ArcGIS

CVE-2024-25694BUG-000163019 - Stored XSS in Portal for ArcGISEsri Enterprise Web App Builder

CVE-2024-25693Portal for ArcGIS has a directory traversal vulnerability.Esri Portal for ArcGIS

CVE-2024-25692BUG-000154722 - Cross-site request forgery (CSRF) issue in Portal for ArcGISEsri Portal for ArcGIS

CVE-2024-25691BUG-000165286 - Reflected XSS in Portal for ArcGISEsri Portal for ArcGIS

CVE-2024-25690HTML injection in ArcGIS Web AppBuilderEsri ArcGIS Enterprise Web App Builder

CVE-2024-10904Stored XSS in Server Admin APIEsri ArcGIS Server

CVE-2023-25848BUG-000158039 - There is an information disclosure issue in ArcGIS Server.Esri ArcGIS Enterprise Server

CVE-2023-25841BUG-000158075 Stored XSS issue in ArcGIS ServerEsri ArcGIS Enterprise Server

CVE-2023-25840BUG-000154070 Stored XSS issue in the ArcGIS REST Services directoryEsri ArcGIS Enterprise Server

CVE-2023-25839BUG-000157278 – ArcGIS Insights has a security vulnerability - desktopEsri ArcGIS Insights

CVE-2023-25838BUG-000157278 – ArcGIS Insights has a security vulnerability.Esri ArcGIS Insights

CVE-2023-25837BUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS.Esri Portal for ArcGIS Sites

CVE-2023-25836BUG-000135364 XSS in 10.8.1 sites builder iframe sourceEsri Portal for ArcGIS Sites

CVE-2023-25835BUG-000153659 ArcGIS Enterprise Sites has a stored XSS vulnerabilityEsri Portal for ArcGIS Sites

CVE-2023-25834BUG-000142922 Incomplete permission changes in specific cases.Esri Portal for ArcGIS

CVE-2023-25833BUG-000155004 HTML injection issue in Portal for ArcGIS.Esri Portal for ArcGIS

CVE-2023-25832BUG-000148346 There is a Cross-Site Request Forgery (CSRF) vulnerability in Portal for ArcGIS.Esri Portal for ArcGIS

CVE-2023-25831BUG-000154236 There is a reflected cross-site scripting (XSS) vulnerability in Portal for ArcGIS.Esri Portal for ArcGIS

CVE-2023-25830BUG-000154662 Reflected XSS vulnerability in Portal for ArcGISEsri Portal for ArcGIS

CVE-2023-25829BUG-000155001 - Unvalidated redirect in Portal for ArcGIS.Esri Portal for ArcGIS

CVE-2022-38212Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)Esri ArcGIS Enterprise

CVE-2022-38211Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only)Esri ArcGIS Enterprise

CVE-2022-38210HTML injection in accountswitcher-callback.html (10.9.1, 10.8.1 and 10.7.1 only)Esri ArcGIS Enterprise

CVE-2022-38209Reflected XSS vulnerability in Portal for ArcGISEsri ArcGIS Quickcapture

CVE-2022-38208Unvalidated redirect in Portal for ArcGISEsri ArcGIS Enterprise

CVE-2022-38207Reflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)Esri ArcGIS Enterprise

CVE-2022-38206Reflected XSS vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only)Esri ArcGIS Enterprise

CVE-2022-38205Portal for ArcGIS has a directory traversal vulnerability (10.9.1, 10.8.1 and 10.7.1 only)Esri ArcGIS Enterprise

CVE-2022-38204Reflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)Esri ArcGIS Enterprise

CVE-2022-38203The allowedProxyHosts property is not fully honored in ArcGIS Enterprise (10.8.1 and 10.7.1 only)Esri Portal for ArcGIS

CVE-2022-38202BUG-000152121 - Directory traversal vulnerability in ArcGIS Server.Esri ArcGIS Server

CVE-2022-38201An unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1.Esri ArcGIS Quickcapture

CVE-2022-38200BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server.Esri ArcGIS Server

CVE-2022-38199BUG-000144172 - Remote file download issue in ArcGIS ServerEsri ArcGIS Server

CVE-2022-38198BUG-000146513 - Reflected XSS vulnerability in ArcGIS ServerEsri ArcGIS Server

CVE-2022-38197BUG-000148347 Unvalidated redirect issues in ArcGIS Server.Esri ArcGIS Server

CVE-2022-38196BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerabilityEsri ArcGIS Server

CVE-2022-38195BUG-000150540 - Reflected XSS vulnerability in ArcGIS ServerEsri ArcGIS Server

CVE-2022-38194Portal for ArcGIS system properties are not properly encrypted (10.8.1 only)Esri Portal for ArcGIS

CVE-2022-38193Code injection issue in Portal for ArcGIS (10.7.1 and 10.8.1)Esri Portal for ArcGIS

CVE-2022-38192There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.Esri Portal for ArcGIS

CVE-2022-38191HTML injection vulnerability in Portal for ArcGISEsri Portal for ArcGIS

CVE-2022-38190Stored cross-site scripting vulnerability in Esri Portal for ArcGIS Configurable AppsEsri Portal for ArcGIS

CVE-2022-38189There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.Esri Portal for ArcGIS

CVE-2022-38188no title heldEsri Portal for ArcGIS

CVE-2022-38187Prevent access to sharing/rest/content/features/analyze to unauthorized usersEsri Portal for ArcGIS

CVE-2022-38186no title heldEsri Portal for ArcGIS

CVE-2022-38184There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1Esri Portal for ArcGIS

CVE-2021-29118Esri ArcReader PMF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEsri ArcReader

CVE-2021-29117arcreader use-after-freeEsri ArcReader

CVE-2021-29116BUG-000142180 Hosted feature services vulnerable to stored XSSEsri ArcGIS Server

CVE-2021-29115An information disclosure vulnerabilityEsri ArcGIS Server

CVE-2021-29114SQL injection vulnerability in ArcGIS ServerEsri ArcGIS Server

CVE-2021-29113Remote file inclusion vulnerability in ArcGIS Server help documentationEsri ArcGIS Server

CVE-2021-29112Esri ArcReader PMF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEsri ArcReader

CVE-2021-29110Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass…Esri Portal for ArcGIS

CVE-2021-29109A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9.Esri Portal for ArcGIS

CVE-2021-29108There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9…Esri Portal for ArcGIS

CVE-2021-29107There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.Esri ArcGIS Server

CVE-2021-29106There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.Esri ArcGIS Server

CVE-2021-29105There is a stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and…Esri ArcGIS Server

CVE-2021-29104There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.Esri ArcGIS Server

CVE-2021-29103There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.Esri ArcGIS Server

CVE-2021-29102There is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.Esri ArcGIS Server

CVE-2021-29101ArcGIS GeoEvent Server has a Directory Traversal security vulnerability.Esri ArcGIS GeoEvent Server

CVE-2021-29100ArcGIS Earth has a File Parsing Directory Traversal VulnerabilityEsri ArcGIS Earth

CVE-2021-29099There is a SQL injection vulnerability in ArcGIS ServerEsri ArcGIS Server

CVE-2021-29098ArcGIS general raster security update: uninitialized pointerEsri ArcGIS Desktop Background Geoprocessing

CVE-2021-29097ArcGIS general raster security update: buffer overflowEsri ArcGIS Desktop Background Geoprocessing

CVE-2021-29096ArcGIS general raster security update: use-after-freeEsri ArcGIS Engine Background Geoprocessing

CVE-2021-29095ArcGIS Server image service and raster analytics security update: uninitialized pointerEsri ArcGIS Server

CVE-2021-29094ArcGIS Server image service and raster analytics security update: buffer overflowEsri ArcGIS Server

CVE-2021-29093ArcGIS Server image service and raster analytics security update: use-after-freeEsri ArcGIS Server

167 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.