# Esri Portal for Arcgis


- [CVE-2024-25693](https://insights.sbomify.com/CVE-2024-25693/): Portal for ArcGIS has a directory traversal vulnerability. (critical 9.9)
- [CVE-2026-13019](https://insights.sbomify.com/CVE-2026-13019/): Missing Authentication (critical 9.8)
- [CVE-2026-33518](https://insights.sbomify.com/CVE-2026-33518/): Incorrect privilege assignment in Portal for ArcGIS (critical 9.8)
- [CVE-2026-33519](https://insights.sbomify.com/CVE-2026-33519/): Incorrect privilege assignment in Portal for ArcGIS (critical 9.8)
- [CVE-2025-2538](https://insights.sbomify.com/CVE-2025-2538/): BUG-000174336 (critical 9.8)
- [CVE-2025-4967](https://insights.sbomify.com/CVE-2025-4967/): Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (critical 9.1)
- [CVE-2023-25832](https://insights.sbomify.com/CVE-2023-25832/): BUG-000148346 There is a Cross-Site Request Forgery (CSRF) vulnerability in Portal for ArcGIS. (high 8.8)
- [CVE-2021-29108](https://insights.sbomify.com/CVE-2021-29108/): Auth bypass in Portal for ArcGIS (high 8.8)
- [CVE-2022-38205](https://insights.sbomify.com/CVE-2022-38205/): Portal for ArcGIS has a directory traversal vulnerability (10.9.1, 10.8.1 and 10.7.1 only) (high 8.6)
- [CVE-2024-25699](https://insights.sbomify.com/CVE-2024-25699/): Portal for ArcGIS has an invalid authentication vulnerability (high 8.5)
- [CVE-2023-25837](https://insights.sbomify.com/CVE-2023-25837/): BUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS. (high 8.4)
- [CVE-2023-25835](https://insights.sbomify.com/CVE-2023-25835/): BUG-000153659 ArcGIS Enterprise Sites has a stored XSS vulnerability (high 8.4)

---
From sbomify Insights: https://insights.sbomify.com/products/esri/portal-for-arcgis/