https://vulnogram.org/ Most recent CVEs assigned by Perforce (perforce). https://vulnogram.org/seaview/icons/perforce.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-103509 https://vulnogram.org/CVE-2026-103509 P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed… High Thu, 15 Oct 2026 14:41:28 GMT https://vulnogram.org/CVE-2026-103508 https://vulnogram.org/CVE-2026-103508 P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. T… High Thu, 15 Oct 2026 14:02:19 GMT https://vulnogram.org/CVE-2026-109758 https://vulnogram.org/CVE-2026-109758 Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation template… Critical Network Exploitable Tue, 13 Oct 2026 04:00:04 GMT https://vulnogram.org/CVE-2026-103510 https://vulnogram.org/CVE-2026-103510 P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compro… Critical Network Exploitable Mon, 05 Oct 2026 08:44:56 GMT https://vulnogram.org/CVE-2026-103511 https://vulnogram.org/CVE-2026-103511 Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory. Medium Mon, 05 Oct 2026 08:40:35 GMT https://vulnogram.org/CVE-2026-103512 https://vulnogram.org/CVE-2026-103512 Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining acces… Medium Mon, 05 Oct 2026 08:36:55 GMT https://vulnogram.org/CVE-2026-103507 https://vulnogram.org/CVE-2026-103507 Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution a… High Mon, 05 Oct 2026 08:31:12 GMT https://vulnogram.org/CVE-2026-100102 https://vulnogram.org/CVE-2026-100102 Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of… Critical Network Exploitable Mon, 05 Oct 2026 08:27:18 GMT https://vulnogram.org/CVE-2026-100103 https://vulnogram.org/CVE-2026-100103 Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to… Critical Network Exploitable Mon, 05 Oct 2026 08:19:47 GMT https://vulnogram.org/CVE-2026-85979 https://vulnogram.org/CVE-2026-85979 Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is pass… High Fri, 11 Sep 2026 14:40:53 GMT https://vulnogram.org/CVE-2026-89212 https://vulnogram.org/CVE-2026-89212 A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including… Critical Network Exploitable Fri, 11 Sep 2026 13:23:56 GMT https://vulnogram.org/CVE-2026-85978 https://vulnogram.org/CVE-2026-85978 An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authen… Critical Network Exploitable Wed, 09 Sep 2026 10:31:55 GMT https://vulnogram.org/CVE-2026-14254 https://vulnogram.org/CVE-2026-14254 A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were processed before the failed-login counter and lockout st… High Network Exploitable Thu, 16 Jul 2026 14:12:56 GMT https://vulnogram.org/CVE-2026-8804 https://vulnogram.org/CVE-2026-8804 Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's loca… Medium Fri, 03 Jul 2026 07:40:15 GMT https://vulnogram.org/CVE-2026-6902 https://vulnogram.org/CVE-2026-6902 A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to address potential security risks. High Network Exploitable Mon, 18 May 2026 07:49:16 GMT https://vulnogram.org/CVE-2026-8654 https://vulnogram.org/CVE-2026-8654 Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host. High Fri, 15 May 2026 05:59:25 GMT https://vulnogram.org/CVE-2026-6043 https://vulnogram.org/CVE-2026-6043 P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed to untrusted networks, allow unauthenticated attackers to create arbitrary user accounts, enumerate existing users, authenticate to accounts with no p… High Network Exploitable Fri, 24 Apr 2026 11:02:50 GMT https://vulnogram.org/CVE-2025-14591 https://vulnogram.org/CVE-2025-14591 In Delphix Continuous Compliance version 2025.3.0 and later, following a recent bug fix to correctly handle CR+LF (Windows and DOS) End-of-Record (EOR) characters in delimited files, an issue was identified: using an incorrect EOR configuration can c… Medium Sat, 20 Dec 2025 03:04:21 GMT https://vulnogram.org/CVE-2025-13472 https://vulnogram.org/CVE-2025-13472 A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a d… Medium Wed, 03 Dec 2025 08:42:27 GMT https://vulnogram.org/CVE-2025-10360 https://vulnogram.org/CVE-2025-10360 In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppe… Medium Wed, 24 Sep 2025 15:49:47 GMT https://vulnogram.org/CVE-2025-5459 https://vulnogram.org/CVE-2025-5459 A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolve… High Thu, 26 Jun 2025 06:30:56 GMT https://vulnogram.org/CVE-2025-2903 https://vulnogram.org/CVE-2025-2903 An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can login via SSH gaining command-line control of the operating system. This allows an attacker to gain access to sen… High Thu, 17 Apr 2025 06:50:11 GMT https://vulnogram.org/CVE-2025-3113 https://vulnogram.org/CVE-2025-3113 A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leverage the application’s built-in Connector functionality to access Continuous Compliance’s internal database. T… Critical Thu, 17 Apr 2025 06:41:47 GMT https://vulnogram.org/CVE-2024-11084 https://vulnogram.org/CVE-2024-11084 Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists. Medium Network Exploitable Tue, 15 Apr 2025 15:34:31 GMT https://vulnogram.org/CVE-2025-1714 https://vulnogram.org/CVE-2025-1714 Lack of Rate Limiting in Sign-up workflow in Perforce Gliffy prior to version 4.14.0-7 on Gliffy online allows attacker to enumerate valid user emails and potentially DOS the server Medium Network Exploitable Wed, 05 Mar 2025 14:56:53 GMT https://vulnogram.org/CVE-2024-5174 https://vulnogram.org/CVE-2024-5174 A flaw in Gliffy results in broken authentication through the reset functionality of the application. Medium Mon, 24 Feb 2025 13:32:19 GMT https://vulnogram.org/CVE-2024-7141 https://vulnogram.org/CVE-2024-7141 Versions of Gliffy Online prior to versions 4.14.0-7 contains a Cross Site Request Forgery (CSRF) flaw. Medium Thu, 20 Feb 2025 18:30:29 GMT https://vulnogram.org/CVE-2021-27017 https://vulnogram.org/CVE-2021-27017 Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data. This is resolved in the Puppet Agent 7.4.0 release. Medium Fri, 07 Feb 2025 19:28:45 GMT https://vulnogram.org/CVE-2024-10315 https://vulnogram.org/CVE-2024-10315 In Gliffy Online an insecure configuration was discovered in versions before 4.14.0-6. Reported by Alpha Inferno PVT LTD. Medium Mon, 11 Nov 2024 19:12:28 GMT https://vulnogram.org/CVE-2024-10314 https://vulnogram.org/CVE-2024-10314 In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the auto-generation function was identified. Reported by Karol Więsek. High Network Exploitable Mon, 11 Nov 2024 14:11:12 GMT https://vulnogram.org/CVE-2024-10344 https://vulnogram.org/CVE-2024-10344 In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the refuse function was identified. Reported by Karol Więsek. High Network Exploitable Mon, 11 Nov 2024 14:08:11 GMT https://vulnogram.org/CVE-2024-10345 https://vulnogram.org/CVE-2024-10345 In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Karol Więsek. High Network Exploitable Mon, 11 Nov 2024 13:28:09 GMT https://vulnogram.org/CVE-2024-9129 https://vulnogram.org/CVE-2024-9129 In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. Reported by Dylan Marino Critical Network Exploitable Tue, 22 Oct 2024 17:09:04 GMT https://vulnogram.org/CVE-2024-9160 https://vulnogram.org/CVE-2024-9160 In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered. Medium Fri, 27 Sep 2024 18:58:43 GMT https://vulnogram.org/CVE-2024-8067 https://vulnogram.org/CVE-2024-8067 In versions of Helix Core prior to 2024.1 Patch 2 (2024.1/2655224) a Windows ANSI API Unicode "best fit" argument injection was identified. Medium Tue, 24 Sep 2024 15:53:35 GMT https://vulnogram.org/CVE-2024-3930 https://vulnogram.org/CVE-2024-3930 In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered. Medium Tue, 30 Jul 2024 18:36:18 GMT https://vulnogram.org/CVE-2024-5250 https://vulnogram.org/CVE-2024-5250 In versions of Akana API Platform prior to 2024.1.0 overly verbose errors can be found in SAML integrations Low Tue, 30 Jul 2024 18:29:11 GMT https://vulnogram.org/CVE-2024-5249 https://vulnogram.org/CVE-2024-5249 In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed. Medium Tue, 30 Jul 2024 18:23:29 GMT https://vulnogram.org/CVE-2024-6727 https://vulnogram.org/CVE-2024-6727 A flaw in versions of Delphix Data Control Tower (DCT) prior to 19.0.0 results in broken authentication through the enable-scale-testing functionality of the application. Medium Mon, 29 Jul 2024 17:52:29 GMT https://vulnogram.org/CVE-2024-6726 https://vulnogram.org/CVE-2024-6726 Versions of Delphix Engine prior to Release 25.0.0.0 contain a flaw which results in Remote Code Execution (RCE). High Mon, 29 Jul 2024 17:27:19 GMT https://vulnogram.org/CVE-2024-3826 https://vulnogram.org/CVE-2024-3826 In versions of Akana in versions prior to and including 2022.1.3 validation is broken when using the SAML Single Sign-On (SSO) functionality. High Tue, 02 Jul 2024 15:49:09 GMT https://vulnogram.org/CVE-2024-3995 https://vulnogram.org/CVE-2024-3995 In Helix ALM versions prior to 2024.2.0, a local command injection was identified. Reported by Bryan Riggins. Low Fri, 28 Jun 2024 19:46:47 GMT https://vulnogram.org/CVE-2024-2796 https://vulnogram.org/CVE-2024-2796 A server-side request forgery (SSRF) was discovered in the Akana API Platform in versions prior to and including 2022.1.3. Reported by Jakob Antonsson. Critical Network Exploitable Thu, 18 Apr 2024 15:04:56 GMT https://vulnogram.org/CVE-2024-3825 https://vulnogram.org/CVE-2024-3825 Versions of the BlazeMeter Jenkins plugin prior to 4.22 contain a flaw which results in credential enumeration Medium Wed, 17 Apr 2024 15:03:14 GMT https://vulnogram.org/CVE-2024-0325 https://vulnogram.org/CVE-2024-0325 In Helix Sync versions prior to 2024.1, a local command injection was identified. Reported by Bryan Riggins. Low Thu, 01 Feb 2024 22:03:57 GMT https://vulnogram.org/CVE-2023-5759 https://vulnogram.org/CVE-2023-5759 In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the buffer was identified. Reported by Jason Geffner. High Network Exploitable Wed, 08 Nov 2023 15:48:18 GMT https://vulnogram.org/CVE-2023-45319 https://vulnogram.org/CVE-2023-45319 In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was identified. Reported by Jason Geffner. High Network Exploitable Wed, 08 Nov 2023 15:43:58 GMT https://vulnogram.org/CVE-2023-45849 https://vulnogram.org/CVE-2023-45849 An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2. Reported by Jason Geffner. Critical Network Exploitable Wed, 08 Nov 2023 15:40:29 GMT https://vulnogram.org/CVE-2023-35767 https://vulnogram.org/CVE-2023-35767 In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Jason Geffner. High Network Exploitable Wed, 08 Nov 2023 15:31:29 GMT https://vulnogram.org/CVE-2023-5309 https://vulnogram.org/CVE-2023-5309 Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations. Medium Tue, 07 Nov 2023 19:01:05 GMT