# cve.now: Pegasystems

The newest entries naming Pegasystems as an affected vendor (up to 200), of 46 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-13761](https://cve.now/CVE-2026-13761.md): Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping. (CVSS 8.8)
- [CVE-2026-10754](https://cve.now/CVE-2026-10754.md): Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls. (CVSS 8.6)
- [CVE-2026-14337](https://cve.now/CVE-2026-14337.md): Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. (CVSS 4.6)
- [CVE-2026-1563](https://cve.now/CVE-2026-1563.md): Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. (CVSS 4.8)
- [CVE-2026-1562](https://cve.now/CVE-2026-1562.md): Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. (CVSS 4.6)
- [CVE-2025-62180](https://cve.now/CVE-2025-62180.md): Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs. (CVSS 7.1)
- [CVE-2026-1711](https://cve.now/CVE-2026-1711.md): Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role. (CVSS 4.8)
- [CVE-2026-1564](https://cve.now/CVE-2026-1564.md): Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role. (CVSS 5.1)
- [CVE-2026-1079](https://cve.now/CVE-2026-1079.md): A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension. (CVSS 6.0)
- [CVE-2026-1078](https://cve.now/CVE-2026-1078.md): An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge. (CVSS 7.2)
- [CVE-2025-62184](https://cve.now/CVE-2025-62184.md): Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. (CVSS 4.8)
- [CVE-2026-0898](https://cve.now/CVE-2026-0898.md): An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25. (CVSS 9.0)
- [CVE-2025-62183](https://cve.now/CVE-2025-62183.md): Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights, impact to Confidentiality and Integrity are low. (CVSS 4.8)
- [CVE-2025-62182](https://cve.now/CVE-2025-62182.md): Pega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potentially upload a malicious file. (CVSS 5.3)
- [CVE-2025-62181](https://cve.now/CVE-2025-62181.md): Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not. (CVSS 5.3)
- [CVE-2025-9559](https://cve.now/CVE-2025-9559.md): Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data (CVSS 6.5)
- [CVE-2025-8681](https://cve.now/CVE-2025-8681.md): Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component (CVSS 5.5)
- [CVE-2025-2161](https://cve.now/CVE-2025-2161.md): Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup (CVSS 7.1)
- [CVE-2025-2160](https://cve.now/CVE-2025-2160.md): Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup (CVSS 8.1)
- [CVE-2024-12211](https://cve.now/CVE-2024-12211.md): Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile. (CVSS 5.4)
- [CVE-2024-10716](https://cve.now/CVE-2024-10716.md): Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search. (CVSS 5.9)
- [CVE-2024-10094](https://cve.now/CVE-2024-10094.md): Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code (CVSS 9.1)
- [CVE-2024-6702](https://cve.now/CVE-2024-6702.md): Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage. (CVSS 5.2)
- [CVE-2024-6701](https://cve.now/CVE-2024-6701.md): Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type. (CVSS 5.5)
- [CVE-2024-6700](https://cve.now/CVE-2024-6700.md): Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name. (CVSS 5.5)
- [CVE-2023-50168](https://cve.now/CVE-2023-50168.md): Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation. (CVSS 7.7)
- [CVE-2023-50167](https://cve.now/CVE-2023-50167.md): Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content. (CVSS 5.4)
- [CVE-2023-50166](https://cve.now/CVE-2023-50166.md): Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter. (CVSS 6.1)
- [CVE-2023-50165](https://cve.now/CVE-2023-50165.md): Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could expose file contents. (CVSS 8.5)
- [CVE-2023-32089](https://cve.now/CVE-2023-32089.md): Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description (CVSS 4.6)
- [CVE-2023-32088](https://cve.now/CVE-2023-32088.md): Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation (CVSS 4.6)
- [CVE-2023-32087](https://cve.now/CVE-2023-32087.md): Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation (CVSS 4.6)
- [CVE-2023-4843](https://cve.now/CVE-2023-4843.md): Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however (CVSS 4.3)
- [CVE-2023-32090](https://cve.now/CVE-2023-32090.md): Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials (CVSS 9.8)
- [CVE-2023-28094](https://cve.now/CVE-2023-28094.md): Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default creden (CVSS 8.1)
- [CVE-2023-26465](https://cve.now/CVE-2023-26465.md): Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue. (CVSS 8.0)
- [CVE-2023-28093](https://cve.now/CVE-2023-28093.md): A user with a compromised configuration can start an unsigned binary as a service. (CVSS 7.5)
- [CVE-2023-26467](https://cve.now/CVE-2023-26467.md): A man in the middle can redirect traffic to a malicious server in a compromised configuration. (CVSS 8.1)
- [CVE-2023-26466](https://cve.now/CVE-2023-26466.md): A user with non-Admin access can change a configuration file on the client to modify the Server URL. (CVSS 7.8)
- [CVE-2022-35656](https://cve.now/CVE-2022-35656.md): Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly. (CVSS 6.8)
- [CVE-2022-35655](https://cve.now/CVE-2022-35655.md): Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting. (CVSS 6.1)
- [CVE-2022-35654](https://cve.now/CVE-2022-35654.md): Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter. (CVSS 6.1)
- [CVE-2022-24083](https://cve.now/CVE-2022-24083.md): Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks. (CVSS 9.8)
- [CVE-2022-24082](https://cve.now/CVE-2022-24082.md): If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filter (CVSS 9.8)
- [CVE-2021-27654](https://cve.now/CVE-2021-27654.md): Forgotten password reset functionality for local accounts can be used to bypass local authentication checks. (CVSS 8.8)
- [CVE-2021-27651](https://cve.now/CVE-2021-27651.md): In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentica (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/pegasystems
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.