pega pega platform

Name: pega pega platform
Brand: pega

productUS

cpe:2.3:a:pega:pega_platform:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

3critical3high21medium1low

updated 2026-10-28

vulnerabilities (29)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2017-11356US	medium6.5	3.50% (89th)	Exploit	no fix	2017-08-02	≤ 7.2_ml0
CVE-2017-11355US	medium6.1	2.90% (87th)	Exploit	no fix	2017-08-02	≤ 7.2_ml0
CVE-2020-15390US	critical9.8	1.35% (71st)	—	no fix	2021-04-12	= 8.4.0.237
CVE-2019-16387US	high8.1	1.04% (64th)	—	no fix	2019-11-26	= 8.3
CVE-2020-8774US	high8.8	0.83% (57th)	—	8.2.6	2020-04-29	< 8.2.6
CVE-2019-16386US	medium4.3	0.78% (56th)	—	no fix	2019-11-26	2 versions
CVE-2019-16388US	medium4.3	0.71% (54th)	—	no fix	2019-11-26	= 8.3
CVE-2020-23957US	medium6.1	0.69% (52nd)	—	no fix	2020-12-15	8.4 → 8.4.2
CVE-2020-24353US	medium6.1	0.65% (51st)	—	8.4	2020-11-09	< 8.4
CVE-2023-32090US	critical9.8OT elevated	0.62% (50th)	—	no fix	2023-08-07	6.1 → 7.3.1
CVE-2023-28094US	critical9.8OT elevated	0.53% (45th)	—	no fix	2023-06-22	6.1 → 8.8.3
CVE-2022-35654US	medium6.1	0.53% (45th)	—	no fix	2022-08-22	8.5.4 → 8.7.3
CVE-2017-17478US	medium4.8	0.50% (43rd)	—	no fix	2018-02-27	7 versions
CVE-2022-35655US	medium6.1	0.48% (42nd)	—	no fix	2022-08-22	7.3 → 8.7.3
CVE-2023-26465US	medium6.1	0.44% (38th)	—	no fix	2023-06-09	7.2 → 8.8.1
CVE-2025-9559US	medium6.5	0.40% (34th)	—	23.1.5	2025-10-16	3 versions
CVE-2023-50168US	high7.7	0.39% (33rd)	—	8.8.5	2024-03-14	< 8.8.5
CVE-2023-4843US	medium4.8	0.34% (27th)	—	no fix	2023-09-08	7.1.0 → 8.8.3
CVE-2022-35656US	medium4.5	0.33% (26th)	—	no fix	2022-08-22	8.3 → 8.7.3
CVE-2024-12211US	—	0.33% (26th)	—	24.1.2	2025-01-13	3 versions
CVE-2023-50167US	medium6.1	0.30% (22nd)	—	8.8.5	2024-03-06	2 versions
CVE-2025-2161US	medium6.1	0.28% (21st)	—	23.1.4	2025-04-14	4 versions
CVE-2025-2160US	medium6.1	0.28% (21st)	—	8.5.5	2025-04-14	4 versions
CVE-2025-62184US	low3.4	0.26% (17th)	—	no fix	2026-03-31	8.1 → 25.1.0
CVE-2026-1563US	medium4.8	0.24% (15th)	—	25.1.3	2026-07-15	2 versions
CVE-2026-1562US	medium4.8	0.24% (15th)	—	24.2.4	2026-07-15	2 versions
CVE-2025-8681US	medium5.4	0.19% (9th)	—	23.1.5	2025-09-10	3 versions
CVE-2026-1711US	medium4.8	0.19% (8th)	—	no fix	2026-04-15	8.1 → 25.1.1
CVE-2026-1564US	medium4.8	0.19% (8th)	—	no fix	2026-04-15	8.1 → 25.1.1

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')18 CVEs
CWE-1393Use of Default Password2 CVEs
CWE-425Direct Request ('Forced Browsing')2 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs
CWE-269Improper Privilege Management1 CVEs
CWE-287Improper Authentication1 CVEs
CWE-352Cross-Site Request Forgery (CSRF)1 CVEs
CWE-611Improper Restriction of XML External Entity Reference1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE29 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan