# cve.now: Perforce

The newest entries naming Perforce as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115731](https://cve.now/CVE-2026-115731.md): Report Deserialization Code Execution (CVSS 9.4)
- [CVE-2026-115732](https://cve.now/CVE-2026-115732.md): Certificate Name Authorization Bypass (CVSS 9.0)
- [CVE-2026-103509](https://cve.now/CVE-2026-103509.md): Credential Disclosure in P4 Search Configuration API (CVSS 8.5)
- [CVE-2026-103508](https://cve.now/CVE-2026-103508.md): Path traversal via logging configuration in P4Search (CVSS 7.3)
- [CVE-2026-109758](https://cve.now/CVE-2026-109758.md): Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized acc (CVSS 9.3)
- [CVE-2026-103510](https://cve.now/CVE-2026-103510.md): Authentication bypass via blank auth token in P4Search (CVSS 9.5)
- [CVE-2026-103511](https://cve.now/CVE-2026-103511.md): Arbitrary file-write via extension installation in P4Search (CVSS 5.1)
- [CVE-2026-103512](https://cve.now/CVE-2026-103512.md): Ticket host-binding bypass via spoofed client IP in P4Search (CVSS 5.3)
- [CVE-2026-103507](https://cve.now/CVE-2026-103507.md): Arbitrary file-write via log configuration path in P4Search (CVSS 7.5)
- [CVE-2026-100102](https://cve.now/CVE-2026-100102.md): RCE via exposed JDWP debug agent in P4Search (CVSS 9.5)
- [CVE-2026-89212](https://cve.now/CVE-2026-89212.md): XML External Entity in Akana API Platform (CVSS 9.2)
- [CVE-2026-85978](https://cve.now/CVE-2026-85978.md): Unauthenticated Remote Code Execution in Akana API Platform (CVSS 10.0)
- [CVE-2026-14254](https://cve.now/CVE-2026-14254.md): Improper Restriction of Excessive Authentication Attempts in Delphix Continuous Data (CVSS 8.3)
- [CVE-2026-8804](https://cve.now/CVE-2026-8804.md): Cleartext Storage of Sensitive Information for Puppet Resource API (CVSS 6.7)
- [CVE-2026-6902](https://cve.now/CVE-2026-6902.md): Code Injection in Perforce P4 (Helix Core) (CVSS 7.7)
- [CVE-2026-6043](https://cve.now/CVE-2026-6043.md): Insecure Default Configuration in P4 Server (CVSS 8.8)
- [CVE-2025-14591](https://cve.now/CVE-2025-14591.md): PII Leak Due to Change in EOR Handling (CVSS 5.3)
- [CVE-2025-13472](https://cve.now/CVE-2025-13472.md): Missing authorization in BlazeMeter Jenkins Plugin (CVSS 5.3)
- [CVE-2025-10360](https://cve.now/CVE-2025-10360.md): Insufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5 (CVSS 6.9)
- [CVE-2025-5459](https://cve.now/CVE-2025-5459.md): OS Command Injection (CVSS 8.6)
- [CVE-2025-2903](https://cve.now/CVE-2025-2903.md): Privilege Chaining in Delphix (CVSS 8.5)
- [CVE-2025-3113](https://cve.now/CVE-2025-3113.md): Improper Access Control in Delphix Masking Engine (CVSS 9.0)
- [CVE-2024-11084](https://cve.now/CVE-2024-11084.md): Potential Username Enumeration in Helix ALM (CVSS 6.3)
- [CVE-2025-1714](https://cve.now/CVE-2025-1714.md): Username Enumeration in Gliffy (CVSS 6.9)
- [CVE-2024-3995](https://cve.now/CVE-2024-3995.md): Command Injection in Helix ALM (CVSS 2.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/perforce
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.