Perforce

Latest CVEs · RSS

• CVE-2026-103509 2026-10-15 · CVSS 8.5
  P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected
• CVE-2026-103508 2026-10-15 · CVSS 7.3
  P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configur
• CVE-2026-109758 2026-10-13 · CVSS 9.3
  Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM en
• CVE-2026-103510 2026-10-05 · CVSS 9.5
  P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with
• CVE-2026-103511 2026-10-05 · CVSS 5.1
  Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token p
• CVE-2026-103512 2026-10-05 · CVSS 5.3
  Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ti
• CVE-2026-103507 2026-10-05 · CVSS 7.5
  Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentic
• CVE-2026-100102 2026-10-05 · CVSS 9.5
  Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can exec
• CVE-2026-100103 2026-10-05 · CVSS 10.0
  Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker
• CVE-2026-85979 2026-09-11 · CVSS 8.6
  Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitra
• CVE-2026-89212 2026-09-11 · CVSS 9.2
  A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The
• CVE-2026-85978 2026-09-09 · CVSS 10.0
  An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the
• CVE-2026-14254 2026-07-16 · CVSS 8.3
  A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication reque
• CVE-2026-8804 2026-07-03 · CVSS 6.7
  Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the re
• CVE-2026-6902 2026-05-18 · CVSS 7.7
  A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to address potential security
• CVE-2026-8654 2026-05-15 · CVSS 8.7
  Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or ta
• CVE-2026-6043 2026-04-24 · CVSS 8.8
  P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed to untrusted networks, allow unauthenticated attackers to cr
• CVE-2025-14591 2025-12-20 · CVSS 5.3
  In Delphix Continuous Compliance version 2025.3.0 and later, following a recent bug fix to correctly handle CR+LF (Windows and DOS) End-of-Record (EOR) characte
• CVE-2025-13472 2025-12-03 · CVSS 5.3
  A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs
• CVE-2025-10360 2025-09-24 · CVSS 6.9
  In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the file
• CVE-2025-5459 2025-06-26 · CVSS 8.6
  A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It af
• CVE-2025-2903 2025-04-17 · CVSS 8.5
  An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can login via SSH gaining c
• CVE-2025-3113 2025-04-17 · CVSS 9.0
  A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leverage the application
• CVE-2024-11084 2025-04-15 · CVSS 6.3
  Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists.
• CVE-2025-1714 2025-03-05 · CVSS 6.9
  Lack of Rate Limiting in Sign-up workflow in Perforce Gliffy prior to version 4.14.0-7 on Gliffy online allows attacker to enumerate valid user emails and poten