CVE Program partner

Pega

Pegasystems Inc.

API
CVEs, 365 days1548 all time, 1 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationPegasystems Inc.
RoleCNA
TypeVendor
Reports tomitre
ScopePegasystems products only.
Advisorieshttps://www.pega.com/trust/security-advisories

Latest CVEs · RSS

  • CVE-2026-13761 2026-08-28 · CVSS 8.8
    Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial
  • CVE-2026-10754 2026-08-10 · CVSS 8.6
    Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security con
  • CVE-2026-14337 2026-08-04 · CVSS 4.6
    Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high p
  • CVE-2026-1563 2026-07-15 · CVSS 4.8
    Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high
  • CVE-2026-1562 2026-07-15 · CVSS 4.6
    Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high pr
  • CVE-2025-62180 2026-06-23 · CVSS 7.1
    Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional d
  • CVE-2026-1711 2026-04-15 · CVSS 4.8
    Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privilege
  • CVE-2026-1564 2026-04-15 · CVSS 5.1
    Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with
  • CVE-2026-1079 2026-04-07 · CVSS 6.0
    A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser E
  • CVE-2026-1078 2026-04-07 · CVSS 7.2
    An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that
  • CVE-2025-62184 2026-03-31 · CVSS 4.8
    Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrati
  • CVE-2026-0898 2026-03-23 · CVSS 9.0
    An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge u
  • CVE-2025-62183 2026-02-17 · CVSS 4.8
    Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrati
  • CVE-2025-62182 2026-01-13 · CVSS 5.3
    Pega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potentiall
  • CVE-2025-62181 2025-12-10 · CVSS 5.3
    Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration. This issue occurs during user authentication process, where a differen
  • CVE-2025-9559 2025-10-16 · CVSS 6.5
    Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to
  • CVE-2025-8681 2025-09-10 · CVSS 5.5
    Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component.  Requires a high privileged user with a develo
  • CVE-2025-2161 2025-04-14 · CVSS 7.1
    Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup
  • CVE-2025-2160 2025-04-14 · CVSS 8.1
    Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup
  • CVE-2024-12211 2025-01-13 · CVSS 5.4
    Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile.
  • CVE-2024-10716 2024-12-05 · CVSS 5.9
    Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search.
  • CVE-2024-10094 2024-11-20 · CVSS 9.1
    Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code
  • CVE-2024-6702 2024-09-12 · CVSS 5.2
    Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.
  • CVE-2024-6701 2024-09-12 · CVSS 5.5
    Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.
  • CVE-2024-6700 2024-09-12 · CVSS 5.5
    Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.

All CVE Program partners