# Esri Portal for ArcGIS. Every CVE that names Esri Portal for ArcGIS among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Portal for ArcGIS has a security vulnerability](https://agentprime.io/advisories/CVE-2026-69226.md) `CVE-2026-69226` · CVE record: Esri Portal for ArcGIS · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control - [BUG-000171040 Portal for ArcGIS has a security vulnerability](https://agentprime.io/advisories/CVE-2026-10759.md) `CVE-2026-10759` · CVE record: Esri Portal for ArcGIS · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection - [BUG-000187331 Portal for ArcGIS has a security vulnerability](https://agentprime.io/advisories/CVE-2026-69227.md) `CVE-2026-69227` · CVE record: Esri Portal for ArcGIS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass - [stored cross site scripting issue in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69233.md) `CVE-2026-69233` · CVE record: Esri Portal for ArcGIS · CVSS 5.5 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [reflected cross site scripting vulnerability in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69234.md) `CVE-2026-69234` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [stored cross site scripting issue in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69235.md) `CVE-2026-69235` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [stored cross site scripting issue in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69236.md) `CVE-2026-69236` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [HTML injection vulnerability in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69237.md) `CVE-2026-69237` · CVE record: Esri Portal for ArcGIS · CVSS 3.8 Low · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [stored cross site scripting issue in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69232.md) `CVE-2026-69232` · CVE record: Esri Portal for ArcGIS · CVSS 5.5 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [stored cross site scripting issue in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69231.md) `CVE-2026-69231` · CVE record: Esri Portal for ArcGIS · CVSS 5.5 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [stored cross site scripting issue in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69230.md) `CVE-2026-69230` · CVE record: Esri Portal for ArcGIS · CVSS 5.5 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [HTML injection vulnerability in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69229.md) `CVE-2026-69229` · CVE record: Esri Portal for ArcGIS · CVSS 5.4 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [missing authentication vulnerability in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69228.md) `CVE-2026-69228` · CVE record: Esri Portal for ArcGIS · CVSS 5.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Authentication bypass - [information disclosure vulnerability in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69225.md) `CVE-2026-69225` · CVE record: Esri Portal for ArcGIS · CVSS 5.9 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [HTML injection vulnerability in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69238.md) `CVE-2026-69238` · CVE record: Esri Portal for ArcGIS · CVSS 3.5 Low · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [information disclosure vulnerability in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69224.md) `CVE-2026-69224` · CVE record: Esri Portal for ArcGIS · CVSS 5.9 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [Missing Authentication](https://agentprime.io/advisories/CVE-2026-13019.md) `CVE-2026-13019` · CVE record: Esri Portal for ArcGIS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-640 - [Weak Password Recovery Mechanism in Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-13020.md) `CVE-2026-13020` · CVE record: Esri Portal for ArcGIS · CVSS 8.1 High · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-640 - [Incorrect privilege assignment in Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-33519.md) `CVE-2026-33519` · CVE record: Esri Portal for ArcGIS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: Privilege escalation - [Incorrect privilege assignment in Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-33518.md) `CVE-2026-33518` · CVE record: Esri Portal for ArcGIS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: Privilege escalation - [BUG-000174020 - Reflected XSS vulnerability identified in Portal for ArcGIS. (11.3, 11.1, 10.9.1)](https://agentprime.io/advisories/CVE-2025-57871.md) `CVE-2025-57871` · CVE record: Esri Portal for ArcGIS · CVSS 4.8 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Cross-site scripting (XSS) - [BUG-000174150 - Unvalidated redirect in Portal for ArcGIS.](https://agentprime.io/advisories/CVE-2025-57872.md) `CVE-2025-57872` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Open redirect - [BUG-000175222 - Reflected XSS vulnerability in Portal for ArcGIS.](https://agentprime.io/advisories/CVE-2025-57873.md) `CVE-2025-57873` · CVE record: Esri Portal for ArcGIS · CVSS 4.8 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Cross-site scripting (XSS) - [BUG-000161627 - Reflected XSS vulnerability in Portal for ArcGIS. (11.3, 11.1, 10.9.1)](https://agentprime.io/advisories/CVE-2025-57874.md) `CVE-2025-57874` · CVE record: Esri Portal for ArcGIS · CVSS 4.8 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Cross-site scripting (XSS) - [BUG-000164122 - Reflected XSS vulnerability in Portal for ArcGIS.](https://agentprime.io/advisories/CVE-2025-57875.md) `CVE-2025-57875` · CVE record: Esri Portal for ArcGIS · CVSS 4.8 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Cross-site scripting (XSS) - [Reflected XSS vulnerability in Portal for ArcGIS.](https://agentprime.io/advisories/CVE-2025-57877.md) `CVE-2025-57877` · CVE record: Esri Portal for ArcGIS · CVSS 4.8 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Cross-site scripting (XSS) - [BUG-000174149 - The Portal for ArcGIS has an unvalidated redirect.](https://agentprime.io/advisories/CVE-2025-57878.md) `CVE-2025-57878` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Open redirect - [BUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS.](https://agentprime.io/advisories/CVE-2025-57879.md) `CVE-2025-57879` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Open redirect - [Stored XSS vulnerability in Portal for ArcGIS](https://agentprime.io/advisories/CVE-2025-57876.md) `CVE-2025-57876` · CVE record: Esri Portal for ArcGIS · CVSS 4.8 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Cross-site scripting (XSS) - [Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS](https://agentprime.io/advisories/CVE-2025-4967.md) `CVE-2025-4967` · CVE record: Esri Portal for ArcGIS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2025 · Tags: Server-side request forgery (SSRF) - [BUG-000174336](https://agentprime.io/advisories/CVE-2025-2538.md) `CVE-2025-2538` · CVE record: Esri Portal for ArcGIS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2025 · Tags: Hard-coded credentials - [BUG-000167984 - Portal for ArcGIS has a Local file inclusion (LFI) vulnerability](https://agentprime.io/advisories/CVE-2024-38040.md) `CVE-2024-38040` · CVE record: Esri Portal for ArcGIS · CVSS 7.5 High · Not analysed yet · Published 4 Oct 2024 · Tags: Path traversal - [BUG-000165732 - Reflected XSS in Portal for ArcGIS](https://agentprime.io/advisories/CVE-2024-38038.md) `CVE-2024-38038` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 4 Oct 2024 · Tags: Cross-site scripting (XSS) - [BUG-000165286 - Reflected XSS in Portal for ArcGIS](https://agentprime.io/advisories/CVE-2024-25691.md) `CVE-2024-25691` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 4 Oct 2024 · Tags: Cross-site scripting (XSS) - [BUG-000160241 - Reflected XSS in Portal for ArcGIS](https://agentprime.io/advisories/CVE-2024-25707.md) `CVE-2024-25707` · CVE record: Esri Portal for ArcGIS · CVSS 4.8 Medium · Not analysed yet · Published 4 Oct 2024 · Tags: Cross-site scripting (XSS) - [BUG-000168624 - Unvalidated redirect in Portal for ArcGIS.](https://agentprime.io/advisories/CVE-2024-8149.md) `CVE-2024-8149` · CVE record: Esri Portal for ArcGIS · CVSS 4.6 Medium · Not analysed yet · Published 4 Oct 2024 · Tags: Cross-site scripting (XSS) - [BUG-000161683 - HTML injection vulnerability in Portal for ArcGIS.](https://agentprime.io/advisories/CVE-2024-38039.md) `CVE-2024-38039` · CVE record: Esri Portal for ArcGIS · CVSS 5.4 Medium · Not analysed yet · Published 4 Oct 2024 · Tags: Cross-site scripting (XSS) - [BUG-000168624 - Unvalidated redirect in Portal for ArcGIS. (11.2, 11.1, 10.9.1. and 10.8.1)](https://agentprime.io/advisories/CVE-2024-8148.md) `CVE-2024-8148` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 4 Oct 2024 · Tags: Open redirect - [BUG-000167983 - Unvalidated redirect in Portal for ArcGIS](https://agentprime.io/advisories/CVE-2024-38037.md) `CVE-2024-38037` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 4 Oct 2024 · Tags: Open redirect - [Portal for ArcGIS has an invalid authentication vulnerability](https://agentprime.io/advisories/CVE-2024-25699.md) `CVE-2024-25699` · CVE record: Esri Portal for ArcGIS · CVSS 8.5 High · Not analysed yet · Published 4 Apr 2024 · Tags: Authentication bypass - [Cross site scripting issue in embed widget](https://agentprime.io/advisories/CVE-2024-25705.md) `CVE-2024-25705` · CVE record: Esri Portal for ArcGIS · CVSS 5.4 Medium · Not analysed yet · Published 4 Apr 2024 · Tags: Cross-site scripting (XSS) - [HTMLi at createFolder Content Injection](https://agentprime.io/advisories/CVE-2024-25706.md) `CVE-2024-25706` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 4 Apr 2024 · Tags: Code injection - [Self-XSS style in move item dialog](https://agentprime.io/advisories/CVE-2024-25709.md) `CVE-2024-25709` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 4 Apr 2024 · Tags: Cross-site scripting (XSS) - [Reflected XSS in Portal for ArcGIS](https://agentprime.io/advisories/CVE-2024-25698.md) `CVE-2024-25698` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 4 Apr 2024 · Tags: Cross-site scripting (XSS) - [Portal for ArcGIS has a directory traversal vulnerability.](https://agentprime.io/advisories/CVE-2024-25693.md) `CVE-2024-25693` · CVE record: Esri Portal for ArcGIS · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Apr 2024 · Tags: Path traversal - [concatenated errors resulting in cross site scripting and frame injection issues.](https://agentprime.io/advisories/CVE-2024-25695.md) `CVE-2024-25695` · CVE record: Esri Portal for ArcGIS · CVSS 7.2 High · Not analysed yet · Published 4 Apr 2024 · Tags: Cross-site scripting (XSS) - [Stored XSS in Portal for ArcGIS](https://agentprime.io/advisories/CVE-2024-25696.md) `CVE-2024-25696` · CVE record: Esri Portal for ArcGIS · CVSS 4.8 Medium · Not analysed yet · Published 4 Apr 2024 · Tags: Cross-site scripting (XSS) - [Stored XSS in Portal for ArcGIS](https://agentprime.io/advisories/CVE-2024-25697.md) `CVE-2024-25697` · CVE record: Esri Portal for ArcGIS · CVSS 5.4 Medium · Not analysed yet · Published 4 Apr 2024 · Tags: Cross-site scripting (XSS) - [BUG-000154722 - Cross-site request forgery (CSRF) issue in Portal for ArcGIS](https://agentprime.io/advisories/CVE-2024-25692.md) `CVE-2024-25692` · CVE record: Esri Portal for ArcGIS · CVSS 5.4 Medium · Not analysed yet · Published 4 Apr 2024 · Tags: Cross-site request forgery (CSRF) - [BUG-000155004 HTML injection issue in Portal for ArcGIS.](https://agentprime.io/advisories/CVE-2023-25833.md) `CVE-2023-25833` · CVE record: Esri Portal for ArcGIS · CVSS 5.4 Medium · Not analysed yet · Published 10 May 2023 · Tags: Cross-site scripting (XSS) - [BUG-000154236 There is a reflected cross-site scripting (XSS) vulnerability in Portal for ArcGIS.](https://agentprime.io/advisories/CVE-2023-25831.md) `CVE-2023-25831` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 9 May 2023 · Tags: Cross-site scripting (XSS) - [BUG-000154662 Reflected XSS vulnerability in Portal for ArcGIS](https://agentprime.io/advisories/CVE-2023-25830.md) `CVE-2023-25830` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 9 May 2023 · Tags: Cross-site scripting (XSS) - [BUG-000155001 - Unvalidated redirect in Portal for ArcGIS.](https://agentprime.io/advisories/CVE-2023-25829.md) `CVE-2023-25829` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 9 May 2023 · Tags: Open redirect - [BUG-000142922 Incomplete permission changes in specific cases.](https://agentprime.io/advisories/CVE-2023-25834.md) `CVE-2023-25834` · CVE record: Esri Portal for ArcGIS · CVSS 5.4 Medium · Not analysed yet · Published 9 May 2023 · Tags: Privilege escalation - [BUG-000148346 There is a Cross-Site Request Forgery (CSRF) vulnerability in Portal for ArcGIS.](https://agentprime.io/advisories/CVE-2023-25832.md) `CVE-2023-25832` · CVE record: Esri Portal for ArcGIS · CVSS 8.8 High · Not analysed yet · Published 9 May 2023 · Tags: Cross-site request forgery (CSRF) - [The allowedProxyHosts property is not fully honored in ArcGIS Enterprise (10.8.1 and 10.7.1 only)](https://agentprime.io/advisories/CVE-2022-38203.md) `CVE-2022-38203` · CVE record: Esri Portal for ArcGIS · CVSS 7.5 High · Not analysed yet · Published 30 Dec 2022 · Tags: Server-side request forgery (SSRF) - [There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.](https://agentprime.io/advisories/CVE-2022-38189.md) `CVE-2022-38189` · CVE record: Esri Portal for ArcGIS · CVSS 5.4 Medium · Not analysed yet · Published 16 Aug 2022 · Tags: Cross-site scripting (XSS) - [There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1](https://agentprime.io/advisories/CVE-2022-38184.md) `CVE-2022-38184` · CVE record: Esri Portal for ArcGIS · CVSS 7.5 High · Not analysed yet · Published 16 Aug 2022 · Tags: Broken access control - [There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.](https://agentprime.io/advisories/CVE-2022-38192.md) `CVE-2022-38192` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 16 Aug 2022 · Tags: Cross-site scripting (XSS) - [Code injection issue in Portal for ArcGIS (10.7.1 and 10.8.1)](https://agentprime.io/advisories/CVE-2022-38193.md) `CVE-2022-38193` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 16 Aug 2022 · Tags: Code injection Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .