PF
Product
Portal for ArcGIS
91
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 8High 16Medium 67Low 0
Watch
Add Portal for ArcGIS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-29109 | 6.1 | Oct 1 | A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could… Affected: through 10.9 |
| CVE-2026-10759 | 5.5 | Oct 13 | BUG-000171040 Portal for ArcGIS has a security vulnerability Affected: through 12.1 |
| CVE-2026-69233 | 5.5 | Aug 21 | stored cross site scripting issue in Esri Portal for ArcGIS Affected: 11.1 through 11.5 |
| CVE-2026-69232 | 5.5 | Aug 21 | stored cross site scripting issue in Esri Portal for ArcGIS Affected: 11.1 through 11.5 |
| CVE-2026-69231 | 5.5 | Aug 21 | stored cross site scripting issue in Esri Portal for ArcGIS Affected: 11.1 through 11.5 |
| CVE-2022-38194 | 5.5 | Aug 16 | In Esri Portal for ArcGIS versions 10.8.1, a system property is not properly encrypted Affected: 10.8.1 |
| CVE-2026-69229 | 5.4 | Aug 21 | HTML injection vulnerability in Esri Portal for ArcGIS Affected: 11.1 through 12.0 |
| CVE-2024-38039 | 5.4 | Oct 4 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when… Affected: through 11.0 |
| CVE-2024-38036 | 5.4 | Oct 4 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a crafted link which when… Affected: 10.7.1; 10.8.1; 10.9.1 |
| CVE-2024-25705 | 5.4 | Apr 4 | There is a cross‑site scripting (XSS) vulnerability in Esri Portal for ArcGIS Experience Builder versions 11.1 and below on Windows and Linux that allows a remote, authenticated… Affected: through 11.1 |
| CVE-2024-25697 | 5.4 | Apr 4 | There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which when… Affected: through 11.1 |
| CVE-2024-25692 | 5.4 | Apr 4 | There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.1 and below that may in some cases allow a remote, unauthenticated attacker to trick an… Affected: through 11.1 |
| CVE-2023-25836 | 5.4 | Jul 21 | There is a Cross-site Scripting vulnerability in Esri Portal for ArcGIS Sites in versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link… Affected: 10.8.1 through 10.9 |
| CVE-2023-25833 | 5.4 | May 10 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when… Affected: through 11.0 |
| CVE-2023-25834 | 5.4 | May 9 | Changes to user permissions in Portal for ArcGIS 10.9.1 and below are incompletely applied in specific use cases Affected: 10.7.1 through 10.9.1 |
| CVE-2022-38189 | 5.4 | Aug 16 | A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries… Affected: All versions, or not specified |
| CVE-2022-38192 | 5.4 | Aug 16 | A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries… Affected: through 10.8.1 |
| CVE-2022-38191 | 5.4 | Aug 15 | There is an HTML injection issue in Esri Portal for ArcGIS versions 10.9.0 and below which may allow a remote, authenticated attacker to inject HTML into some locations in the… Affected: through 10.9 |
| CVE-2021-29110 | 5.4 | Oct 1 | Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application Affected: through 10.9 |
| CVE-2026-69228 | 5.3 | Aug 21 | missing authentication vulnerability in Esri Portal for ArcGIS Affected: 11.1 through 12.0 |
| CVE-2026-69237 | 4.8 | Aug 21 | HTML injection vulnerability in Esri Portal for ArcGIS Affected: 11.1 through 11.3 |
| CVE-2026-69230 | 4.8 | Aug 21 | stored cross site scripting issue in Esri Portal for ArcGIS Affected: 11.1 through 11.5 |
| CVE-2026-69238 | 4.8 | Aug 21 | HTML injection vulnerability in Esri Portal for ArcGIS Affected: 11.1 through 11.5 |
| CVE-2025-57871 | 4.8 | Sep 29 | BUG-000174020 - Reflected XSS vulnerability identified in Portal for ArcGIS. (11.3, 11.1, 10.9.1) Affected: 10.9.1 through 11.4 |
| CVE-2025-57873 | 4.8 | Sep 29 | BUG-000175222 - Reflected XSS vulnerability in Portal for ArcGIS. Affected: 10.9.1 through 11.4 |
| CVE-2025-57874 | 4.8 | Sep 29 | BUG-000161627 - Reflected XSS vulnerability in Portal for ArcGIS. (11.3, 11.1, 10.9.1) Affected: 10.9.1 through 11.4 |
| CVE-2025-57875 | 4.8 | Sep 29 | BUG-000164122 - Reflected XSS vulnerability in Portal for ArcGIS. Affected: 10.9.1 through 11.4 |
| CVE-2025-57877 | 4.8 | Sep 29 | Reflected XSS vulnerability in Portal for ArcGIS. Affected: 10.9.1 through 11.4 |
| CVE-2025-57876 | 4.8 | Sep 29 | Stored XSS vulnerability in Portal for ArcGIS Affected: 10.9.1 through 11.4 |
| CVE-2025-55107 | 4.8 | Aug 21 | BUG-000177335 ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability. Affected: 10.9.1 through 11.4 |
| CVE-2025-55106 | 4.8 | Aug 21 | BUG-000173171 ArcGIS Enterprise Sites has a Cross-site Scripting vulnerability. Affected: 10.9.1 through 11.4 |
| CVE-2025-55105 | 4.8 | Aug 21 | BUG-000177336 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability. Affected: 10.9.1 through 11.4 |
| CVE-2025-55104 | 4.8 | Aug 21 | BUG-000173918 - ArcGIS Enterprise Sites has a security vulnerability. Affected: 10.9.1 through 11.4 |
| CVE-2025-55103 | 4.8 | Aug 21 | BUG-000177333 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability. Affected: 10.9.1; 11.1; 11.2; 11.4 |
| CVE-2024-25707 | 4.8 | Oct 4 | There is a reflected cross site scripting in Esri Portal for ArcGIS 11.1 and below on Windows and Linux x64 allows a remote authenticated attacker with administrative access to… Affected: through 11.1 |
| CVE-2024-25702 | 4.8 | Oct 4 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 11.1 and below that may allow a remote, authenticated attacker to create a… Affected: 10.8.1 through 11.1 |
| CVE-2024-25701 | 4.8 | Oct 4 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Experience Builder versions 11.1 and below that may allow a remote, authenticated… Affected: 10.8.1 through 11.1 |
| CVE-2024-25694 | 4.8 | Oct 4 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise versions 11.1 and below that may allow a remote, authenticated attacker to create a… Affected: 10.8.1 through 10.9.1 |
| CVE-2024-25696 | 4.8 | Apr 4 | There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when… Affected: through 11.0 |
| CVE-2024-25690 | 4.7 | Apr 4 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when… Affected: through 11.1 |
| CVE-2024-8149 | 4.6 | Oct 4 | There is a reflected Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 and 11.2 that may allow a remote, authenticated attacker with low‑privileged… Affected: 11.1; 11.2 |