The Breaking Monero explains where Monero's privacy weaknesses are.

The Monero Blockchain at large cannot be cracked, broken, or traced, however with multiple factors individual transactions could increase probabilistic guesses.

These factors are malicious nodes (also an issue in Tor), poisoned outputs where you reduce the anonymity set (thus reducing the probability), and EAE/EABE attacks where the end points of a transaction could be hypothetically tied (however this is counteracted by avoiding KYC generally).

There's a few other attacks I'm less familiar with but those are the most commonly discussed ones.

https://youtube.com/playlist?list=PLsSYUeVwrHBnAUre2G_LYDsdo-tD0ov-y