Pega vulnerabilities

Products

• Platform 29
• Infinity 10
• Platform 8
• Synchronization Engine 3

Newest

• pega platform, pegasystems pega infinity +1 more Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. CVE-2026-1563 4.8 MediumJuly 15, 2026
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. CVE-2026-1562 4.6 MediumJuly 15, 2026
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role. CVE-2026-1711 4.8 MediumApril 15, 2026
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role. CVE-2026-1564 5.1 MediumApril 15, 2026
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. CVE-2025-62184 4.8 MediumMarch 31, 2026
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data CVE-2025-9559 6.5 MediumOctober 16, 2025
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component CVE-2025-8681 5.5 MediumSeptember 10, 2025
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup CVE-2025-2160 8.1 HighApril 14, 2025
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup CVE-2025-2161 Fix available 7.1 HighFebruary 3, 2025
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile. CVE-2024-12211 5.4 MediumJanuary 13, 2025
• pega infinity, pegasystems pega infinity +1 more Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search. CVE-2024-10716 5.9 MediumDecember 5, 2024
• pega infinity, pegasystems pega infinity +1 more Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of... CVE-2024-10094 9.1 CriticalNovember 20, 2024
• pega infinity, pegasystems pega infinity +1 more Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage. CVE-2024-6702 5.2 MediumSeptember 12, 2024
• pega infinity, pegasystems pega infinity +1 more Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type. CVE-2024-6701 5.5 MediumSeptember 12, 2024
• pega infinity, pegasystems pega infinity +1 more Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name. CVE-2024-6700 5.5 MediumSeptember 12, 2024
• pega platform, pegasystems pega platform +1 more Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation. CVE-2023-50168 7.7 HighMarch 14, 2024
• pega platform, pegasystems pega platform +1 more Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html... CVE-2023-50167 5.4 MediumMarch 6, 2024
• pega platform, pegasystems pega platform +1 more Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and... CVE-2023-50166 6.1 MediumJanuary 31, 2024
• pega platform, pegasystems pega platform +1 more Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could... CVE-2023-50165 8.5 HighJanuary 31, 2024
• pega platform, pegasystems pega platform +1 more Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description CVE-2023-32089 4.6 MediumOctober 18, 2023
• pega platform, pegasystems pega platform +1 more Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case... CVE-2023-32088 4.6 MediumOctober 18, 2023
• pega platform, pegasystems pega platform +1 more Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation CVE-2023-32087 4.6 MediumOctober 18, 2023
• pega platform, pegasystems pega platform +1 more Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field... CVE-2023-4843 4.3 MediumSeptember 8, 2023
• pega platform, pegasystems pega platform +1 more Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default... CVE-2023-32090 9.8 CriticalAugust 7, 2023
• pega platform, pegasystems pega platform +1 more Pega platform clients who are using versions 6.1 through 8.8.3 and have upgraded from a version... CVE-2023-28094 8.1 HighJune 22, 2023
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue. CVE-2023-26465 8.0 HighJune 9, 2023
• pega synchronization engine, pegasystems rpa: synchronization engine +1 more A user with a compromised configuration can start an unsigned binary as a service. CVE-2023-28093 7.5 HighApril 10, 2023
• pega synchronization engine, pegasystems rpa: synchronization engine +1 more A man in the middle can redirect traffic to a malicious server in a compromised configuration. CVE-2023-26467 8.1 HighApril 10, 2023
• pega synchronization engine, pegasystems rpa: synchronization engine +1 more A user with non-Admin access can change a configuration file on the client to modify the Server URL. CVE-2023-26466 7.8 HighApril 10, 2023
• pega platform, pegasystems pega infinity +1 more Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to... CVE-2022-35656 6.8 MediumAugust 22, 2022
• pega platform, pegasystems pega infinity +1 more Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a... CVE-2022-35655 6.1 MediumAugust 22, 2022
• pega platform, pegasystems pega infinity +1 more Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and... CVE-2022-35654 6.1 MediumAugust 22, 2022
• pega infinity, pegasystems pega infinity +1 more Password authentication bypass vulnerability for local accounts can be used to bypass local... CVE-2022-24083 9.8 CriticalJuly 25, 2022
• pega infinity, pegasystems pega infinity +1 more If an on-premise installation of the Pega Platform is configured with the port for the JMX... CVE-2022-24082 Public exploit EPSS 12.2% 9.8 CriticalJuly 19, 2022
• pega infinity, pegasystems pega infinity +1 more Forgotten password reset functionality for local accounts can be used to bypass local... CVE-2021-27654 8.8 HighJanuary 28, 2022
• pega infinity, pegasystems pega infinity +1 more In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local... CVE-2021-27651 Public exploit EPSS 53.8% 9.8 CriticalApril 29, 2021
• pega platform pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper... CVE-2020-15390 9.8 CriticalApril 12, 2021
• pega infinity, pegasystems pega infinity +1 more Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead... CVE-2021-27653 6.6 MediumApril 1, 2021
• pega platform Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID... CVE-2020-23957 6.1 MediumDecember 15, 2020
• pega platform Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header. CVE-2020-24353 6.1 MediumNovember 9, 2020
• pega platform Pega Platform 8.2.1 allows LDAP injection because a username can contain a * character and can be... CVE-2019-16374 9.8 CriticalAugust 13, 2020
• pega platform Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting (XSS)... CVE-2020-8775 8.9 HighApril 29, 2020
• pega platform The Richtext Editor in Pega Platform before 8.2.6 is affected by a Stored Cross-Site Scripting ... CVE-2020-8773 8.9 HighApril 29, 2020
• pega platform Pega Platform before version 8.2.6 is affected by a Reflected Cross-Site Scripting vulnerability... CVE-2020-8774 8.8 HighApril 29, 2020
• pega platform PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/... CVE-2019-16388 Disputed 4.3 MediumNovember 26, 2019
• pega platform PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/random_token/!STANDARD?pyActivity=Data... CVE-2019-16387 Disputed 8.1 HighNovember 26, 2019
• pega platform PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso... CVE-2019-16386 Disputed 4.3 MediumNovember 26, 2019
• pega platform An XSS issue was discovered in Designer Studio in Pegasystems Pega Platform 7.1.7, 7.1.8, 7.1.9,... CVE-2017-17478 4.8 MediumFebruary 27, 2018
• pega platform The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows... CVE-2017-11356 Public exploit 6.5 MediumAugust 2, 2017
• pega platform Multiple cross-site scripting (XSS) vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow... CVE-2017-11355 Public exploit 6.1 MediumAugust 2, 2017