Login Request a demo
PE
Vendor
Pega
4 products with CVEs on record
50
CVEs
0
On KEV
0
New 30D
Products
PP
Pega Platform
Pega
9.8
29 CVEs0 on KEV0 new
IN
Infinity
Pega
9.8
10 CVEs0 on KEV0 new
PL
Platform
Pega
9.8
8 CVEs0 on KEV0 new
SE
Synchronization Engine
Pega
7.8
3 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-1563
PP
Pega Platform
Pega
4.8
0%
Jul 15Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
CVE-2026-1562
PP
Pega Platform
Pega
4.8
0%
Jul 15Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
CVE-2026-1711
PP
Pega Platform
Pega
4.8
0%
Apr 15Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role.
CVE-2026-1564
PP
Pega Platform
Pega
4.8
0%
Apr 15Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role.
CVE-2025-62184
PP
Pega Platform
Pega
3.4
0%
Mar 31Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component.
CVE-2025-9559
PP
Pega Platform
Pega
6.5
0%
Oct 16Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data
CVE-2025-8681
PP
Pega Platform
Pega
5.4
0%
Sep 10Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component
CVE-2025-2161
PP
Pega Platform
Pega
6.1
0%
Apr 14Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup
CVE-2025-2160
PP
Pega Platform
Pega
6.1
0%
Apr 14Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup
CVE-2024-12211
PP
Pega Platform
Pega
5.4
0%
Jan 13Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile
CVE-2024-10716
IN
Infinity
Pega
4.8
0%
Dec 5Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search
CVE-2024-10094
IN
Infinity
Pega
9.8
0%
Nov 20Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code
CVE-2024-6702
IN
Infinity
Pega
4.8
0%
Sep 12Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage
CVE-2024-6701
IN
Infinity
Pega
4.8
0%
Sep 12Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type
CVE-2024-6700
IN
Infinity
Pega
4.8
0%
Sep 12Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name
CVE-2023-50168
PP
Pega Platform
Pega
7.7
0%
Mar 14Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation
CVE-2023-50167
PP
Pega Platform
Pega
6.1
0%
Mar 6Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content
CVE-2023-50166
PL
Platform
Pega
6.1
0%
Jan 31Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter
CVE-2023-50165
PL
Platform
Pega
8.6
0%
Jan 31Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could expose file contents
CVE-2023-32089
PL
Platform
Pega
6.1
0%
Oct 18Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description
CVE-2023-32088
PL
Platform
Pega
6.1
0%
Oct 18Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation
CVE-2023-32087
PL
Platform
Pega
6.1
0%
Oct 18Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation
CVE-2023-4843
PP
Pega Platform
Pega
4.8
0%
Sep 8Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however this field can only be modified by an…
CVE-2023-32090
PP
Pega Platform
Pega
9.8
1%
Aug 7Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials
CVE-2023-28094
PP
Pega Platform
Pega
9.8
1%
Jun 22Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials
CVE-2023-26465
PP
Pega Platform
Pega
6.1
0%
Jun 9Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue
CVE-2023-26467
SE
Synchronization Engine
Pega
5.4
1%
Apr 10A man in the middle can redirect traffic to a malicious server in a compromised configuration
CVE-2023-28093
SE
Synchronization Engine
Pega
6.5
1%
Apr 10A user with a compromised configuration can start an unsigned binary as a service
CVE-2023-26466
SE
Synchronization Engine
Pega
7.8
0%
Apr 10A user with non-Admin access can change a configuration file on the client to modify the Server URL
CVE-2022-35656
PP
Pega Platform
Pega
4.5
0%
Aug 22Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly
CVE-2022-35655
PP
Pega Platform
Pega
6.1
0%
Aug 22Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting
CVE-2022-35654
PP
Pega Platform
Pega
6.1
1%
Aug 22Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter
CVE-2022-24083
IN
Infinity
Pega
9.8
1%
Jul 25Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks
CVE-2022-24082
IN
Infinity
Pega
9.8
12%
Jul 19If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it…
CVE-2021-27654
IN
Infinity
Pega
7.8
1%
Jan 28Forgotten password reset functionality for local accounts can be used to bypass local authentication checks
CVE-2021-27651
IN
Infinity
Pega
9.8
54%
Apr 29In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks
CVE-2020-15390
PP
Pega Platform
Pega
9.8
1%
Apr 12pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo
CVE-2021-27653
IN
Infinity
Pega
4.9
1%
Apr 1Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure
CVE-2020-23957
PP
Pega Platform
Pega
6.1
1%
Dec 15Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession…
CVE-2020-24353
PP
Pega Platform
Pega
6.1
1%
Nov 9Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header
CVE-2019-16374
PL
Platform
Pega
9.8
2%
Aug 13Pega Platform 8.2.1 allows LDAP injection because a username can contain a * character and can be of unlimited length
CVE-2020-8775
PL
Platform
Pega
8.9
1%
Apr 29Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the comment tags
CVE-2020-8774
PP
Pega Platform
Pega
8.8
1%
Apr 29Pega Platform before version 8.2.6 is affected by a Reflected Cross-Site Scripting vulnerability in the "ActionStringID" function
CVE-2020-8773
PL
Platform
Pega
8.9
1%
Apr 29The Richtext Editor in Pega Platform before 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability
CVE-2019-16388
PP
Pega Platform
Pega
4.3
1%
Nov 26PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyStream=MyAlerts request to get Audit Log information while using a…
CVE-2019-16387
PP
Pega Platform
Pega
8.1
1%
Nov 26PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/random_token/!STANDARD?pyActivity=Data-Admin-DB-Name.DBSchema_ListDatabases request while using a low-privilege account
CVE-2019-16386
PP
Pega Platform
Pega
4.3
1%
Nov 26PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyActivity=GetWebInfo&target=popup&pzHarnessID=random_harness_id…
CVE-2017-17478
PP
Pega Platform
Pega
4.8
1%
Feb 27An XSS issue was discovered in Designer Studio in Pegasystems Pega Platform 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2, 7.2.1, and 7.2.2
CVE-2017-11356
PP
Pega Platform
Pega
6.5
4%
Aug 2The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users with certain privileges to obtain sensitive configuration…
CVE-2017-11355
PP
Pega Platform
Pega
6.1
3%
Aug 2Multiple cross-site scripting (XSS) vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to the…