Skip to content
Noroxi

Esri records

182 published records for vendor esri.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
33
With a fix record
1.1%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 25
  9. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

182 records
  • CVE-2007-1770
    45Plan

    Buffer overflow in the ArcSDE service (giomgr) in Environmental Systems Research Institute (ESRI) ArcGIS before 9.2 Service Pack 2, when usi

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    esri · arcsdeMar 29, 2007

  • CVE-2012-1661
    44Plan

    ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assi

    CriticalCVSS 9.3Proof of conceptEPSS 23%

    esri · arcmapJul 12, 2012

  • CVE-2015-2002
    40Plan

    The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a

    CriticalCVSS 9.8No exploitEPSS 2%

    esri · arcgisruntime sdkMar 29, 2018

  • CVE-2025-57870
    40Plan

    BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.

    CriticalCVSS 10.0No exploitEPSS 0%

    esri · arcgis serverOct 22, 2025

  • CVE-2020-35712
    39Monitor

    Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations.

    CriticalCVSS 9.8No exploitEPSS 1%

    esri · arcgis serverDec 25, 2020

  • CVE-2024-25693
    39Monitor

    Portal for ArcGIS has a directory traversal vulnerability.

    CriticalCVSS 9.9No exploitEPSS 1%

    esri · portal for arcgisApr 4, 2024

  • CVE-2021-29114
    39Monitor

    SQL injection vulnerability in ArcGIS Server

    CriticalCVSS 9.8No exploitEPSS 1%

    esri · arcgis serverDec 7, 2021

  • CVE-2026-13019
    39Monitor

    Missing Authentication

    CriticalCVSS 9.8No exploitEPSS 0%

    esri · portal for arcgisJul 7, 2026

  • CVE-2026-9182
    39Monitor

    Unvalidated File Upload vulnerability in ArcGIS Server.

    CriticalCVSS 9.8No exploitEPSS 0%

    esri · arcgis serverJul 6, 2026

  • CVE-2025-2538
    39Monitor

    A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may all

    CriticalCVSS 9.8No exploitEPSS 0%

    esri · portal for arcgisMar 20, 2025

  • CVE-2026-33519
    39Monitor

    Incorrect privilege assignment in Portal for ArcGIS

    CriticalCVSS 9.8No exploitEPSS 0%

    esri · portal for arcgisApr 21, 2026

  • CVE-2026-13020
    39Monitor

    Weak Password Recovery Mechanism in Portal for ArcGIS

    CriticalCVSS 9.8No exploitEPSS 0%

    esri · portal for arcgisJul 7, 2026

  • CVE-2022-38193
    38Monitor

    Code injection issue in Portal for ArcGIS (10.7.1 and 10.8.1)

    CriticalCVSS 9.6No exploitEPSS 0%

    esri · portal for arcgisAug 16, 2022

  • CVE-2021-29102
    36Monitor

    There is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.

    CriticalCVSS 9.1No exploitEPSS 1%

    esri · arcgis serverJul 10, 2021

  • CVE-2025-4967
    36Monitor

    Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS

    CriticalCVSS 9.1No exploitEPSS 0%

    esri · portal for arcgisMay 29, 2025

  • CVE-2021-29108
    35Monitor

    There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below.

    HighCVSS 8.8No exploitEPSS 0%

    esri · portal for arcgisOct 1, 2021

  • CVE-2023-25832
    35Monitor

    BUG-000148346 There is a Cross-Site Request Forgery (CSRF) vulnerability in Portal for ArcGIS.

    HighCVSS 8.8No exploitEPSS 0%

    esri · portal for arcgisMay 9, 2023

  • CVE-2024-25699
    34Monitor

    Portal for ArcGIS has an invalid authentication vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    esri · portal for arcgisApr 4, 2024

  • CVE-2024-51962
    34Monitor

    SQL injection vulnerability in ArcGIS Server

    HighCVSS 8.7No exploitEPSS 0%

    esri · arcgis serverMar 3, 2025

  • CVE-2024-51954
    34Monitor

    Unauthorized access to secure services in ArcGIS Server

    HighCVSS 8.5No exploitEPSS 0%

    linux · linux kernelMar 3, 2025

  • CVE-2023-25837
    33Monitor

    BUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS.

    HighCVSS 8.4No exploitEPSS 0%

    esri · portal for arcgisJul 21, 2023

  • CVE-2023-25835
    33Monitor

    BUG-000153659 ArcGIS Enterprise Sites has a stored XSS vulnerability

    HighCVSS 8.4No exploitEPSS 0%

    esri · portal for arcgisJul 20, 2023

  • CVE-2021-29097
    32Monitor

    ArcGIS general raster security update: buffer overflow

    HighCVSS 7.8No exploitEPSS 2%

    esri · arcgis engineMar 25, 2021

  • CVE-2021-29098
    32Monitor

    ArcGIS general raster security update: uninitialized pointer

    HighCVSS 7.8No exploitEPSS 2%

    esri · arcgis engineMar 25, 2021

  • CVE-2022-38196
    32Monitor

    BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerability

    HighCVSS 8.1No exploitEPSS 1%

    esri · arcgis serverOct 25, 2022