Login Request a demo
PI
Product
Pega Infinity
by Pegasystems · last CVE Aug 28, 2026
12
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities12In the news0Timeline
Severity mix
Critical 0High 3Medium 8Low 1
Severity
All severities12Critical0High3Medium8Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Pega Infinity to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-13761
8.8
0%
Aug 28
Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Affected: 7.1.0 before Infinity 25.1.3
CVE-2026-10754
8.6
1%
Aug 10
Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.
Affected: 8.5.0 before Infinity 25.1.3
CVE-2025-62180
7.1
0%
Jun 23
Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.
Affected: 8.3.0 before Infinity 25.1.3
CVE-2025-62182
5.3
0%
Jan 13
Pega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potentially upload a malicious file.
Affected: 8.7.0 before Infinity 25.1.1
CVE-2025-62181
5.3
0%
Dec 10
Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.
Affected: 7.1.0 before Infinity 25.1.1
CVE-2026-1563
4.8
0%
Jul 15
Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
Affected: 8.1.0 before Infinity 25.1.2
CVE-2026-1562
4.8
0%
Jul 15
Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
Affected: 8.1.0 before Infinity 25.1.2
CVE-2026-1711
4.8
0%
Apr 15
Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role.
Affected: 8.1.0 before Infinity 25.1.2
CVE-2026-1564
4.8
0%
Apr 15
Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role.
Affected: 8.1.0 before Infinity 25.1.2
CVE-2025-62183
4.8
0%
Feb 17
Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights, impact to Confidentiality and Integrity are low.
Affected: 8.1.0 before Infinity 25.1.1
CVE-2026-14337
4.6
0%
Aug 4
Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
Affected: 23.1.0 before Infinity 25.1.4
CVE-2025-62184
3.4
0%
Mar 31
Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component.
Affected: 8.1.0 before Infinity 25.1.0
Showing 12