https://vulnogram.org/ Most recent CVEs assigned by Environmental Systems Research Institute, Inc. (esri). https://vulnogram.org/seaview/icons/esri.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-69226 https://vulnogram.org/CVE-2026-69226 A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating… Medium Network Exploitable Tue, 13 Oct 2026 16:06:23 GMT https://vulnogram.org/CVE-2026-10759 https://vulnogram.org/CVE-2026-10759 A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input tha… Medium Tue, 13 Oct 2026 16:04:54 GMT https://vulnogram.org/CVE-2026-69227 https://vulnogram.org/CVE-2026-69227 A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication. Critical Network Exploitable Tue, 13 Oct 2026 16:03:43 GMT https://vulnogram.org/CVE-2026-10758 https://vulnogram.org/CVE-2026-10758 Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker wh… High Network Exploitable Fri, 25 Sep 2026 20:49:43 GMT https://vulnogram.org/CVE-2026-69233 https://vulnogram.org/CVE-2026-69233 There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. User… Medium Fri, 21 Aug 2026 20:54:13 GMT https://vulnogram.org/CVE-2026-69234 https://vulnogram.org/CVE-2026-69234 There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript co… Medium Network Exploitable Fri, 21 Aug 2026 20:54:00 GMT https://vulnogram.org/CVE-2026-69235 https://vulnogram.org/CVE-2026-69235 There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with Ar… Medium Network Exploitable Fri, 21 Aug 2026 20:53:48 GMT https://vulnogram.org/CVE-2026-69236 https://vulnogram.org/CVE-2026-69236 There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users work… Medium Network Exploitable Fri, 21 Aug 2026 20:53:36 GMT https://vulnogram.org/CVE-2026-69237 https://vulnogram.org/CVE-2026-69237 There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, an… Low Fri, 21 Aug 2026 20:53:21 GMT https://vulnogram.org/CVE-2026-69232 https://vulnogram.org/CVE-2026-69232 There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users work… Medium Fri, 21 Aug 2026 20:49:34 GMT https://vulnogram.org/CVE-2026-69231 https://vulnogram.org/CVE-2026-69231 There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users work… Medium Fri, 21 Aug 2026 20:49:17 GMT https://vulnogram.org/CVE-2026-69230 https://vulnogram.org/CVE-2026-69230 There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. User… Medium Fri, 21 Aug 2026 20:49:01 GMT https://vulnogram.org/CVE-2026-69229 https://vulnogram.org/CVE-2026-69229 There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 1… Medium Fri, 21 Aug 2026 20:48:46 GMT https://vulnogram.org/CVE-2026-69228 https://vulnogram.org/CVE-2026-69228 There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) that should only be accessible by authenticated users… Medium Network Exploitable Fri, 21 Aug 2026 20:48:27 GMT https://vulnogram.org/CVE-2026-69225 https://vulnogram.org/CVE-2026-69225 There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in a http response body. Medium Network Exploitable Fri, 21 Aug 2026 20:46:39 GMT https://vulnogram.org/CVE-2026-69238 https://vulnogram.org/CVE-2026-69238 There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.… Low Fri, 21 Aug 2026 20:46:03 GMT https://vulnogram.org/CVE-2026-69224 https://vulnogram.org/CVE-2026-69224 There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier that may under difficult to reproduce circumstances allow a remote, unauthenticated attacker to reflect sensitive information in a http response body… Medium Network Exploitable Fri, 21 Aug 2026 20:45:03 GMT https://vulnogram.org/CVE-2026-13019 https://vulnogram.org/CVE-2026-13019 Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are kno… Critical Network Exploitable Tue, 07 Jul 2026 16:40:53 GMT https://vulnogram.org/CVE-2026-13020 https://vulnogram.org/CVE-2026-13020 A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mecha… High Network Exploitable Tue, 07 Jul 2026 16:39:16 GMT https://vulnogram.org/CVE-2026-9181 https://vulnogram.org/CVE-2026-9181 Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit this issue by sending crafted path parameters. Successful exploitation could allow overwriting… Critical Network Exploitable Mon, 06 Jul 2026 18:22:08 GMT https://vulnogram.org/CVE-2026-9182 https://vulnogram.org/CVE-2026-9182 Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially a… Critical Network Exploitable Mon, 06 Jul 2026 18:21:11 GMT https://vulnogram.org/CVE-2026-2813 https://vulnogram.org/CVE-2026-2813 ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a specially crafted request, Successful exploitation may result in the application redirecting the br… Medium Network Exploitable Wed, 20 May 2026 17:51:51 GMT https://vulnogram.org/CVE-2026-2812 https://vulnogram.org/CVE-2026-2812 ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker could exploit this issue by sending a crafted request to the endpoint. Successful exploitation may result in disru… Medium Network Exploitable Wed, 20 May 2026 17:47:40 GMT https://vulnogram.org/CVE-2026-33519 https://vulnogram.org/CVE-2026-33519 An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials. Critical Network Exploitable Tue, 21 Apr 2026 20:38:28 GMT https://vulnogram.org/CVE-2026-33518 https://vulnogram.org/CVE-2026-33518 An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create developer credentials that may grant more privileges than expected. Critical Network Exploitable Tue, 21 Apr 2026 20:37:52 GMT https://vulnogram.org/CVE-2026-1446 https://vulnogram.org/CVE-2026-1446 There is a Cross‑Site Scripting (XSS) issue in Esri ArcGIS Pro versions 3.6.0 and earlier. ArcGIS Pro is a desktop application, and exploitation is limited to local users interacting with the application; no privileged role or elevated permissions ar… Medium Mon, 26 Jan 2026 17:24:12 GMT https://vulnogram.org/CVE-2025-67711 https://vulnogram.org/CVE-2025-67711 There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context o… Medium Network Exploitable Wed, 31 Dec 2025 22:18:57 GMT https://vulnogram.org/CVE-2025-67710 https://vulnogram.org/CVE-2025-67710 There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context o… Medium Network Exploitable Wed, 31 Dec 2025 22:18:17 GMT https://vulnogram.org/CVE-2025-67709 https://vulnogram.org/CVE-2025-67709 There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context o… Medium Network Exploitable Wed, 31 Dec 2025 22:17:41 GMT https://vulnogram.org/CVE-2025-67708 https://vulnogram.org/CVE-2025-67708 There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context o… Medium Network Exploitable Wed, 31 Dec 2025 22:17:08 GMT https://vulnogram.org/CVE-2025-67707 https://vulnogram.org/CVE-2025-67707 ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories. However, the server’s archit… Medium Network Exploitable Wed, 31 Dec 2025 22:16:14 GMT https://vulnogram.org/CVE-2025-67706 https://vulnogram.org/CVE-2025-67706 ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories. However, the server’s archit… Medium Network Exploitable Wed, 31 Dec 2025 22:15:44 GMT https://vulnogram.org/CVE-2025-67705 https://vulnogram.org/CVE-2025-67705 There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context o… Medium Network Exploitable Wed, 31 Dec 2025 22:15:05 GMT https://vulnogram.org/CVE-2025-67704 https://vulnogram.org/CVE-2025-67704 There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context o… Medium Network Exploitable Wed, 31 Dec 2025 22:14:32 GMT https://vulnogram.org/CVE-2025-67703 https://vulnogram.org/CVE-2025-67703 There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context o… Medium Network Exploitable Wed, 31 Dec 2025 22:13:12 GMT https://vulnogram.org/CVE-2025-67712 https://vulnogram.org/CVE-2025-67712 There is an HTML injection issue in Esri ArcGIS Web AppBuilder developer edition versions prior to 2.30 that allows a remote, unauthenticated attacker to potentially entice a user to click a link that causes arbitrary HTML to render in a victim's bro… Medium Network Exploitable Unsupported When Assigned Fri, 19 Dec 2025 20:05:42 GMT https://vulnogram.org/CVE-2025-57870 https://vulnogram.org/CVE-2025-57870 A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Ser… Critical Network Exploitable Wed, 22 Oct 2025 14:26:22 GMT https://vulnogram.org/CVE-2025-57871 https://vulnogram.org/CVE-2025-57871 There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the… Medium Mon, 29 Sep 2025 18:39:13 GMT https://vulnogram.org/CVE-2025-57872 https://vulnogram.org/CVE-2025-57872 There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks. Medium Network Exploitable Mon, 29 Sep 2025 18:38:34 GMT https://vulnogram.org/CVE-2025-57873 https://vulnogram.org/CVE-2025-57873 There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the… Medium Mon, 29 Sep 2025 18:37:54 GMT https://vulnogram.org/CVE-2025-57874 https://vulnogram.org/CVE-2025-57874 There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the… Medium Mon, 29 Sep 2025 18:37:16 GMT https://vulnogram.org/CVE-2025-57875 https://vulnogram.org/CVE-2025-57875 There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the… Medium Mon, 29 Sep 2025 18:35:34 GMT https://vulnogram.org/CVE-2025-57877 https://vulnogram.org/CVE-2025-57877 There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the… Medium Mon, 29 Sep 2025 18:34:59 GMT https://vulnogram.org/CVE-2025-57878 https://vulnogram.org/CVE-2025-57878 There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks. Medium Network Exploitable Mon, 29 Sep 2025 18:33:59 GMT https://vulnogram.org/CVE-2025-57879 https://vulnogram.org/CVE-2025-57879 There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks. Medium Network Exploitable Mon, 29 Sep 2025 18:33:06 GMT https://vulnogram.org/CVE-2025-57876 https://vulnogram.org/CVE-2025-57876 There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary… Medium Mon, 29 Sep 2025 18:32:20 GMT https://vulnogram.org/CVE-2025-55107 https://vulnogram.org/CVE-2025-55107 There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could pote… Medium Thu, 21 Aug 2025 19:29:59 GMT https://vulnogram.org/CVE-2025-55106 https://vulnogram.org/CVE-2025-55106 There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could pote… Medium Thu, 21 Aug 2025 19:29:37 GMT https://vulnogram.org/CVE-2025-55105 https://vulnogram.org/CVE-2025-55105 There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could pote… Medium Thu, 21 Aug 2025 19:29:01 GMT https://vulnogram.org/CVE-2025-55104 https://vulnogram.org/CVE-2025-55104 A stored cross-site scripting (XSS) vulnerability exists ArcGIS HUB and ArcGIS Enterprise Sites which allows an authenticated user with the ability to create or edit a site to add and store an XSS payload. If this stored XSS payload is triggered by a… Medium Thu, 21 Aug 2025 19:28:43 GMT