Pegasystems vulnerabilities
46 published CVEs name Pegasystems among the affected products.
- 46Published CVEs46 of them scored
- 15Last 12 monthspublished in the last year
- 6Critical14 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-13761
Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Pegasystems · Pega Infinity
High8.8 - CVE-2026-10754
Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.
Pegasystems · Pega Infinity
High8.6 - CVE-2026-14337
Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
Pegasystems · Pega Infinity
Medium4.6 - CVE-2026-1563
Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
Pegasystems · Pega Infinity
Medium4.8 - CVE-2026-1562
Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
Pegasystems · Pega Infinity
Medium4.6 - CVE-2025-62180
Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.
Pegasystems · Pega Infinity
High7.1 - CVE-2026-1711
Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role.
Pegasystems · Pega Infinity
Medium4.8 - CVE-2026-1564
Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role.
Pegasystems · Pega Infinity
Medium5.1 - CVE-2026-1079
A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension.
Pegasystems · Pega Browser Extension (PBE)
Medium6.0 - CVE-2026-1078
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge.
Pegasystems · Pega Robot Studio
High7.2