Pegasystems vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20226
3. 202310
4. 20249
5. 20256
6. 202614

Newest CVEs

• CVE-2026-13761

  Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

  Pegasystems · Pega Infinity

  High8.8
• CVE-2026-10754

  Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.

  Pegasystems · Pega Infinity

  High8.6
• CVE-2026-14337

  Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

  Pegasystems · Pega Infinity

  Medium4.6
• CVE-2026-1563

  Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

  Pegasystems · Pega Infinity

  Medium4.8
• CVE-2026-1562

  Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

  Pegasystems · Pega Infinity

  Medium4.6
• CVE-2025-62180

  Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.

  Pegasystems · Pega Infinity

  High7.1
• CVE-2026-1711

  Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role.

  Pegasystems · Pega Infinity

  Medium4.8
• CVE-2026-1564

  Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role.

  Pegasystems · Pega Infinity

  Medium5.1
• CVE-2026-1079

  A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension.

  Pegasystems · Pega Browser Extension (PBE)

  Medium6.0
• CVE-2026-1078

  An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge.

  Pegasystems · Pega Robot Studio

  High7.2