Threats affecting pkg:maven/com.pega/pega-infinity

3 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	5.1	EPSS 0.2%	CVE-2026-1564Pegasystems Pega Infinity · Basic XSS Medium5.1EPSS 0.2%2026-04-15CVE Database V5CVE-2026-1564 CVE-2026-1564 is an HTML Injection vulnerability affecting Pegasystems Pega Infinity versions 8.1.0 through 25.1.1. It involves improper neutralization of script-related HTML tags in a user interface component. Exploitation requires a high privileged user with a developer role. The vulnerability has a medium severity with a CVSS score of 5.1. No official patch or remediation guidance is currently provided by the vendor. EPSS 0.2%Vulnerability CWE-80	CVE Database V5	2026-04-15
Medium	4.8	EPSS 0.3%	CVE-2025-62184Pegasystems Pega Infinity · Cross-site Scripting Medium4.8EPSS 0.3%2026-03-31CVE Database V5CVE-2025-62184 Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights, impact to Confidentiality is low and Integrity is none. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2026-03-31
Medium	6.5	EPSS 0.4%	CVE-2025-9559Pegasystems Pega Infinity · Insecure Direct Object Reference Medium6.5EPSS 0.4%2025-10-16CVE Database V5CVE-2025-9559 Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data. EPSS 0.4%Vulnerability CWE-639	CVE Database V5	2025-10-16

Page 1 of 1