Log in Start free

Pegasystems

Products

ProductCVEsExploitedLatest
Pega Infinity30–Aug 28, 2026
Pega Platform10–Mar 14, 2024
RPA: Synchronization Engine3–Apr 10, 2023
Pega Robot Studio2–Apr 7, 2026
Pega Browser Extension (PBE)1–Apr 7, 2026

Exploited and recent CVEs

  • CVE-2026-13761 High 8.8 Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping. 0.4%
  • CVE-2026-10754 High 8.6 Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls. 0.8%
  • CVE-2026-14337 Medium 4.6 Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. 0.4%
  • CVE-2026-1563 Medium 4.8 Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. 0.2%
  • CVE-2026-1562 Medium 4.6 Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. 0.2%
  • CVE-2025-62180 High 7.1 Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs. 0.4%
  • CVE-2026-1711 Medium 4.8 Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role. 0.2%
  • CVE-2026-1564 Medium 5.1 Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role. 0.2%
  • CVE-2026-1079 Medium 6.0 A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension. 0.3%
  • CVE-2026-1078 High 7.2 An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge. 0.3%
  • CVE-2025-62184 Medium 4.8 Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. 0.3%
  • CVE-2026-0898 Critical 9.0 An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25. 0.3%
  • CVE-2025-62183 Medium 4.8 Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights, impact to Confidentiality and Integrity are low. 0.3%
  • CVE-2025-62182 Medium 5.3 Pega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potentially upload a malicious file. 0.3%
  • CVE-2025-62181 Medium 5.3 Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not. 0.4%
  • CVE-2025-9559 Medium 6.5 Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data 0.4%
  • CVE-2025-8681 Medium 5.5 Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component 0.2%
  • CVE-2025-2161 High 7.1 Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup 0.3%
  • CVE-2025-2160 High 8.1 Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup 0.3%
  • CVE-2024-12211 Medium 5.4 Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile. 0.3%
  • CVE-2024-10716 Medium 5.9 Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search. 0.2%
  • CVE-2024-10094 Critical 9.1 Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code 0.5%
  • CVE-2024-6702 Medium 5.2 Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage. 0.3%
  • CVE-2024-6701 Medium 5.5 Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type. 0.3%
  • CVE-2024-6700 Medium 5.5 Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name. 0.3%
  • CVE-2023-50168 High 7.7 Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation. 0.4%
  • CVE-2023-50167 Medium 5.4 Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content. 0.3%
  • CVE-2023-50166 Medium 6.1 Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter. 0.3%
  • CVE-2023-50165 High 8.5 Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could expose file contents. 0.3%
  • CVE-2023-32089 Medium 4.6 Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description 0.3%