Security Bulletin: IBM Maximo Application Suite - Location Service for Esri Component uses pymongo-4.18.1 and is vulnerable to CVE-2026-96747, CVE-2026-96748, CVE-2026-96749

Summary IBM Maximo Application Suite - Location Service for Esri Component uses pymongo-4.18.1 and is vulnerable to CVE-2026-96747, CVE-2026-96748, CVE-2026-96749. This bulletin contains information regarding these vulnerabilities and their fixtures. Vulnerability Details CVEID:CVE-2026-96747...

CVE-2026-50096

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided...

CVE-2026-50095

There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser. A patch is provided for...

CVE-2026-33520

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided...

CVE-2026-33521

There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny service to users. A patch is provided for...

CVE-2026-33522

Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, and 11.3. Other versions are in mature or...

CVE-2026-10757

There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service which could, depending on the service being configured in a non-default access configuration “public”, include an...

CVE-2026-50096 BUG-000187164 - ArcGIS Server has a security vulnerability.

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided...

EUVD-2026-110062

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided...

CVE-2026-50096

A reflected cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 12.1 and prior. This flaw allows a remote, unauthenticated attacker to craft a malicious link that, when clicked, can execute arbitrary JavaScript code in the victim's browser. Remediation is available ...

EUVD-2026-110061

There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser. A patch is provided for...

EUVD-2026-110060

Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, and 11.3. Other versions are in mature or...

EUVD-2026-110059

There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny service to users. A patch is provided for...

EUVD-2026-110058

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided...

CVE-2026-33520 BUG-000185167 - ArcGIS Server has a security vulnerability.

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided...

CVE-2026-33520

A reflected cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 12.1 and prior. A remote, unauthenticated attacker can craft a malicious link that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser. A patch is available for ArcGIS Serve...

EUVD-2026-110057

There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service which could, depending on the service being configured in a non-default access configuration “public”, include an...

PT-2026-125081

Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, and 11.3. Other versions are in mature or...

Esri ArcGIS Server cross-site scripting vulnerability

Esri ArcGIS Server versions 12.1 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from reflected XSS, which may allow remote unauthenticated attackers to create specially crafted links. Upon clicking these links, arbitrary JavaScript code can be executed in the...

Esri ArcGIS Server authorization issue vulnerability

Versions 11.3 through 12.0 of Esri ArcGIS Server contain an authorization issue vulnerability. This vulnerability stems from improper permission control, allowing remote unauthenticated attackers to update service metadata...