| CVE-2026-1563 | 中4.8 | Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. | 15/07/2026 |
| CVE-2026-1562 | 中4.8 | Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. | 15/07/2026 |
| CVE-2026-1711 | 中4.8 | Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role. | 15/04/2026 |
| CVE-2026-1564 | 中4.8 | Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role. | 15/04/2026 |
| CVE-2025-62184 | 低3.4 | Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights, impact to Confidentiality is low and Integrity is none. | 31/03/2026 |
| CVE-2025-9559 | 中6.5 | Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data. | 16/10/2025 |
| CVE-2025-8681 | 中5.4 | Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component. Requires a high privileged user with a developer role. | 10/09/2025 |
| CVE-2025-2161 | 中6.1 | Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup | 14/04/2025 |
| CVE-2025-2160 | 中6.1 | Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup | 14/04/2025 |
| CVE-2024-12211 | 中5.4 | Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile. | 13/01/2025 |
| CVE-2023-50168 | 高7.7 | Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation. | 14/03/2024 |
| CVE-2023-50167 | 中6.1 | Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content. | 06/03/2024 |
| CVE-2023-4843 | 中4.8 | Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however this field can only be modified by an authenticated administrative user. | 08/09/2023 |
| CVE-2023-32090 | 緊急9.8 | Pega platform clients who are using versions 6.1 through 7.3.1 may be
utilizing default credentials
| 07/08/2023 |
| CVE-2023-28094 | 緊急9.8 | Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials. | 22/06/2023 |
| CVE-2023-26465 | 中6.1 | Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue. | 09/06/2023 |
| CVE-2022-35656 | 中4.5 | Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly. | 22/08/2022 |
| CVE-2022-35655 | 中6.1 | Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting. | 22/08/2022 |
| CVE-2022-35654 | 中6.1 | Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter. | 22/08/2022 |
| CVE-2020-15390 | 緊急9.8 | pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo. | 12/04/2021 |