https://vulnogram.org/ Most recent CVEs assigned by Pegasystems Inc. (pega). https://vulnogram.org/seaview/icons/pega.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-13761 https://vulnogram.org/CVE-2026-13761 Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping. High Network Exploitable Fri, 28 Aug 2026 13:11:34 GMT https://vulnogram.org/CVE-2026-10754 https://vulnogram.org/CVE-2026-10754 Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls. High Mon, 10 Aug 2026 17:38:01 GMT https://vulnogram.org/CVE-2026-14337 https://vulnogram.org/CVE-2026-14337 Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. Medium Tue, 04 Aug 2026 13:48:40 GMT https://vulnogram.org/CVE-2026-1563 https://vulnogram.org/CVE-2026-1563 Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. Medium Wed, 15 Jul 2026 16:38:21 GMT https://vulnogram.org/CVE-2026-1562 https://vulnogram.org/CVE-2026-1562 Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. Medium Wed, 15 Jul 2026 16:37:13 GMT https://vulnogram.org/CVE-2025-62180 https://vulnogram.org/CVE-2025-62180 Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs. High Tue, 23 Jun 2026 14:48:36 GMT https://vulnogram.org/CVE-2026-1711 https://vulnogram.org/CVE-2026-1711 Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role. Medium Wed, 15 Apr 2026 21:32:51 GMT https://vulnogram.org/CVE-2026-1564 https://vulnogram.org/CVE-2026-1564 Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role. Medium Wed, 15 Apr 2026 21:31:19 GMT https://vulnogram.org/CVE-2026-1079 https://vulnogram.org/CVE-2026-1079 A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension. A bad actor could create a website that contains malicious code that targets PBE… Medium Network Exploitable Tue, 07 Apr 2026 15:17:47 GMT https://vulnogram.org/CVE-2026-1078 https://vulnogram.org/CVE-2026-1078 An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge. A bad actor could create a website that includ… High Network Exploitable Tue, 07 Apr 2026 15:04:32 GMT https://vulnogram.org/CVE-2025-62184 https://vulnogram.org/CVE-2025-62184 Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights, impact to Confidentiality is low and Integrity i… Medium Tue, 31 Mar 2026 17:52:07 GMT https://vulnogram.org/CVE-2026-0898 https://vulnogram.org/CVE-2026-0898 An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25. This vulnerability does not affect Robot Runtime users. A… Critical Network Exploitable Mon, 23 Mar 2026 18:41:52 GMT https://vulnogram.org/CVE-2025-62183 https://vulnogram.org/CVE-2025-62183 Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights, impact to Confidentiality and Integrity are low. Medium Tue, 17 Feb 2026 22:53:22 GMT https://vulnogram.org/CVE-2025-62182 https://vulnogram.org/CVE-2025-62182 Pega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potentially upload a malicious file. Medium Tue, 13 Jan 2026 16:37:06 GMT https://vulnogram.org/CVE-2025-62181 https://vulnogram.org/CVE-2025-62181 Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is… Medium Network Exploitable Wed, 10 Dec 2025 20:41:08 GMT https://vulnogram.org/CVE-2025-9559 https://vulnogram.org/CVE-2025-9559 Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data. Medium Thu, 16 Oct 2025 15:28:18 GMT https://vulnogram.org/CVE-2025-8681 https://vulnogram.org/CVE-2025-8681 Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component. Requires a high privileged user with a developer role. Medium Wed, 10 Sep 2025 16:00:15 GMT https://vulnogram.org/CVE-2025-2161 https://vulnogram.org/CVE-2025-2161 Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup High Network Exploitable Mon, 14 Apr 2025 14:19:37 GMT https://vulnogram.org/CVE-2025-2160 https://vulnogram.org/CVE-2025-2160 Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup High Network Exploitable Mon, 14 Apr 2025 14:16:34 GMT https://vulnogram.org/CVE-2024-12211 https://vulnogram.org/CVE-2024-12211 Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile. Medium Mon, 13 Jan 2025 16:14:59 GMT https://vulnogram.org/CVE-2024-10716 https://vulnogram.org/CVE-2024-10716 Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search. Medium Network Exploitable Thu, 05 Dec 2024 15:28:29 GMT https://vulnogram.org/CVE-2024-10094 https://vulnogram.org/CVE-2024-10094 Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code Critical Wed, 20 Nov 2024 14:45:22 GMT https://vulnogram.org/CVE-2024-6702 https://vulnogram.org/CVE-2024-6702 Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage. Medium Thu, 12 Sep 2024 14:25:44 GMT https://vulnogram.org/CVE-2024-6701 https://vulnogram.org/CVE-2024-6701 Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type. Medium Thu, 12 Sep 2024 14:25:28 GMT https://vulnogram.org/CVE-2024-6700 https://vulnogram.org/CVE-2024-6700 Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name. Medium Thu, 12 Sep 2024 14:24:08 GMT https://vulnogram.org/CVE-2023-50168 https://vulnogram.org/CVE-2023-50168 Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation. High Thu, 14 Mar 2024 15:40:23 GMT https://vulnogram.org/CVE-2023-50167 https://vulnogram.org/CVE-2023-50167 Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content. Medium Wed, 06 Mar 2024 17:15:08 GMT https://vulnogram.org/CVE-2023-50166 https://vulnogram.org/CVE-2023-50166 Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter. Medium Network Exploitable Wed, 31 Jan 2024 17:26:42 GMT https://vulnogram.org/CVE-2023-50165 https://vulnogram.org/CVE-2023-50165 Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could expose file contents. High Wed, 31 Jan 2024 17:21:04 GMT https://vulnogram.org/CVE-2023-32089 https://vulnogram.org/CVE-2023-32089 Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description Medium Wed, 18 Oct 2023 11:45:16 GMT https://vulnogram.org/CVE-2023-32088 https://vulnogram.org/CVE-2023-32088 Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation Medium Wed, 18 Oct 2023 11:42:31 GMT https://vulnogram.org/CVE-2023-32087 https://vulnogram.org/CVE-2023-32087 Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation Medium Wed, 18 Oct 2023 11:39:51 GMT https://vulnogram.org/CVE-2023-4843 https://vulnogram.org/CVE-2023-4843 Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however this field can only be modified by an authenticated administrative user. Medium Fri, 08 Sep 2023 16:06:44 GMT https://vulnogram.org/CVE-2023-32090 https://vulnogram.org/CVE-2023-32090 Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials Critical Network Exploitable Mon, 07 Aug 2023 11:53:48 GMT https://vulnogram.org/CVE-2023-28094 https://vulnogram.org/CVE-2023-28094 Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials. High Network Exploitable Thu, 22 Jun 2023 00:00:00 GMT https://vulnogram.org/CVE-2023-26465 https://vulnogram.org/CVE-2023-26465 Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue. High Fri, 09 Jun 2023 00:00:00 GMT https://vulnogram.org/CVE-2023-28093 https://vulnogram.org/CVE-2023-28093 A user with a compromised configuration can start an unsigned binary as a service. High Mon, 10 Apr 2023 00:00:00 GMT https://vulnogram.org/CVE-2023-26467 https://vulnogram.org/CVE-2023-26467 A man in the middle can redirect traffic to a malicious server in a compromised configuration. High Mon, 10 Apr 2023 00:00:00 GMT https://vulnogram.org/CVE-2023-26466 https://vulnogram.org/CVE-2023-26466 A user with non-Admin access can change a configuration file on the client to modify the Server URL. High Mon, 10 Apr 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-35656 https://vulnogram.org/CVE-2022-35656 Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly. Medium Mon, 22 Aug 2022 14:47:57 GMT https://vulnogram.org/CVE-2022-35655 https://vulnogram.org/CVE-2022-35655 Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting. Medium Network Exploitable Mon, 22 Aug 2022 14:47:36 GMT https://vulnogram.org/CVE-2022-35654 https://vulnogram.org/CVE-2022-35654 Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter. Medium Network Exploitable Mon, 22 Aug 2022 14:46:53 GMT https://vulnogram.org/CVE-2022-24083 https://vulnogram.org/CVE-2022-24083 Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks. Critical Network Exploitable Mon, 25 Jul 2022 16:07:16 GMT https://vulnogram.org/CVE-2022-24082 https://vulnogram.org/CVE-2022-24082 If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying… Critical Network Exploitable Tue, 19 Jul 2022 00:00:00 GMT https://vulnogram.org/CVE-2021-27654 https://vulnogram.org/CVE-2021-27654 Forgotten password reset functionality for local accounts can be used to bypass local authentication checks. High Network Exploitable Fri, 28 Jan 2022 19:09:31 GMT https://vulnogram.org/CVE-2021-27651 https://vulnogram.org/CVE-2021-27651 In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks. Critical Network Exploitable Thu, 29 Apr 2021 14:47:20 GMT https://vulnogram.org/CVE-2021-27653 https://vulnogram.org/CVE-2021-27653 Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure. Medium Thu, 01 Apr 2021 18:38:57 GMT