Vendor
Perforce
48 known vulnerabilities in products by Perforce, 0 of them actively exploited (CISA KEV).
Key figures
48
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
9
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-85978 | Unauthenticated Remote Code Execution in Akana API Platform | 9.8 | |
| Critical | CVE-2015-8965 | Perforce JViews: security vulnerability | 9.8 | |
| High | CVE-2025-5459 | OS Command Injection | 8.8 | |
| High | CVE-2026-6043 | Insecure Default Configuration in P4 Server | — | |
| Critical | CVE-2026-103510 | Authentication bypass via blank auth token in P4Search | — | |
| Critical | CVE-2026-100102 | RCE via exposed JDWP debug agent in P4Search | — | |
| Critical | CVE-2023-45849 | Arbitrary Code Execution in Helix Core | 9.0 | |
| Critical | CVE-2026-89212 | XML External Entity in Akana API Platform | 8.6 | |
| Critical | CVE-2026-109758 | Perforce Helix Authentication Service: Prototype Pollution | — | |
| High | CVE-2026-103507 | Arbitrary file-write via log configuration path in P4Search | — | |
| High | CVE-2026-14254 | Improper Restriction of Excessive Authentication Attempts in Delphix Continuous Data | — | |
| High | CVE-2026-103508 | Path traversal via logging configuration in P4Search | — | |
| Medium | CVE-2013-1410 | Perforce P4web: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2026-103509 | Credential Disclosure in P4 Search Configuration API | — | |
| Not rated | CVE-2008-1303 | Perforce Server: NULL Pointer Dereference | — | |
| High | CVE-2023-5759 | Unauthenticated Remote Denial-of-Service via Buffer in Helix Core | 7.5 | |
| High | CVE-2023-35767 | Unauthenticated Remote Denial-of-Service via Shutdown Function in Helix Core | 7.5 | |
| High | CVE-2023-45319 | Unauthenticated Remote Denial-of-Service (Commit) in Helix Core | 7.5 | |
| High | CVE-2026-6902 | Code Injection in Perforce P4 (Helix Core) | — | |
| Medium | CVE-2026-103512 | Ticket host-binding bypass via spoofed client IP in P4Search | — | |
| Medium | CVE-2026-103511 | Arbitrary file-write via extension installation in P4Search | — | |
| Critical | CVE-2025-3113 | Improper Access Control in Delphix Masking Engine | — | |
| Medium | CVE-2018-1000147 | Perforce: security vulnerability | 6.5 | |
| Medium | CVE-2021-28973 | Perforce Helix ALM: XML External Entity (XXE) | 4.9 | |
| High | CVE-2025-14591 | PII Leak Due to Change in EOR Handling | 7.5 |
Products
| Perforce Server | 10 | 0 |
| P4 (helix Core) | 8 | 0 |
| Helix Core | 4 | 0 |
| Akana API Platform | 3 | 0 |
| Helix Alm | 3 | 0 |
| Puppet Enterprise | 3 | 0 |