Priority MEDIUM 44
Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive loopin…
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00428 · Published 2026-08-28 · Fixed in Infinity 25.1.3 CWE-606
Priority MEDIUM 41
Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.
CVSS 4.0HIGH 8.6· Network · Low privileges · No interaction · EPSS 0.00777 · Published 2026-08-10 · Fixed in Infinity 25.1.3 CWE-347
Priority LOW 22
Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component.
CVSS 4.0MEDIUM 4.6· Network · High privileges · User interaction · EPSS 0.00418 · Published 2026-08-04 · Fixed in Infinity 25.1.4 CWE-79
Priority LOW 22
Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component.
CVSS 4.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00242 · Published 2026-07-15 · Fixed in Infinity 25.1.2 CWE-79
Priority LOW 21
Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component.
CVSS 4.0MEDIUM 4.6· Network · High privileges · User interaction · EPSS 0.00242 · Published 2026-07-15 · Fixed in Infinity 25.1.2 CWE-79
Priority LOW 31
Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00364 · Published 2026-06-23 · Fixed in Infinity 25.1.3 CWE-639
Priority LOW 21
Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component.
CVSS 4.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00187 · Published 2026-04-15 · Fixed in Infinity 25.1.2 CWE-79
Priority LOW 22
Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00187 · Published 2026-04-15 · Fixed in Infinity 25.1.2 CWE-80
Priority LOW 26
A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension.
CVSS 4.0MEDIUM 6.0· Network · No auth · User interaction · EPSS 0.00271 · Published 2026-04-07 · Fixed in 3.1.45 CWE-284
Priority LOW 32
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge.
CVSS 4.0HIGH 7.2· Network · No auth · User interaction · EPSS 0.00334 · Published 2026-04-07 · No fix listed CWE-284
Priority LOW 22
Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component.
CVSS 4.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00268 · Published 2026-03-31 · Fixed in Infinity 25.1.0 CWE-79
Priority MEDIUM 41
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25.
CVSS 4.0CRITICAL 9.0· Network · No auth · User interaction · EPSS 0.00334 · Published 2026-03-23 · No fix listed CWE-284
Priority LOW 22
Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component.
CVSS 4.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00291 · Published 2026-02-17 · Fixed in Infinity 25.1.1 CWE-79
Priority LOW 24
Pega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potentially upload a malicious file.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00268 · Published 2026-01-13 · Fixed in Infinity 25.1.1 CWE-434
Priority LOW 30
Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00441 · Published 2025-12-10 · Fixed in Infinity 25.1.1 CWE-204
Priority LOW 29
Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00409 · Published 2025-10-16 · Fixed in Infinity 24.2.3 CWE-639
Priority LOW 24
Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component.
CVSS 3.1MEDIUM 5.5· Network · High privileges · No interaction · EPSS 0.00195 · Published 2025-09-10 · Fixed in Infinity 24.2.3 CWE-79
Priority LOW 31
Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.00287 · Published 2025-04-14 · Fixed in 24.2.2 CWE-79
Priority LOW 35
Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00287 · Published 2025-04-14 · Fixed in 24.2.2 CWE-79
Priority LOW 24
Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00326 · Published 2025-01-13 · Fixed in 24.2.1 CWE-79
Priority LOW 26
Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search.
CVSS 3.1MEDIUM 5.9· Network · No auth · User interaction · EPSS 0.00215 · Published 2024-12-05 · Fixed in 24.2.1 CWE-79
Priority MEDIUM 43
Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0048 · Published 2024-11-20 · Fixed in 24.1.2 CWE-94
Priority LOW 23
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.
CVSS 3.1MEDIUM 5.2· Network · High privileges · User interaction · EPSS 0.00259 · Published 2024-09-12 · Fixed in 24.1.3 CWE-74
Priority LOW 24
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.
CVSS 3.1MEDIUM 5.5· Network · High privileges · No interaction · EPSS 0.00259 · Published 2024-09-12 · Fixed in 24.1.3 CWE-79
Priority LOW 24
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.
CVSS 3.1MEDIUM 5.5· Network · High privileges · No interaction · EPSS 0.00259 · Published 2024-09-12 · Fixed in 24.1.3 CWE-79
Load more
THREATIST.IORead the docs