Skip to content
OpenAdvisories

Vendor

Perforce

26 known vulnerabilities.

Products

P4 (Helix Core) 8 Puppet Enterprise 6 Helix ALM 2 Akana 2 Delphix 2 Helix Core Server (P4D) 1 Gliffy 1 Delphix Continuous Data 1 Delphix Continuous Compliance 1 BlazeMeter 1 Puppet Core 1 Helix Authentication Service 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-115731

    Report Deserialization Code Execution

    Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by sub…

    Perforce Puppet Enterprise puppet puppet Debian Ubuntu Azure Linux
  • Critical 9.0
    CVE-2026-115732

    Certificate Name Authorization Bypass

    Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authori…

    Perforce Puppet Enterprise puppetserver trapperkeeper-authorization-clojure Debian Ubuntu
  • Critical 9.3
    CVE-2026-109758

    Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerabl…

    Perforce Helix Authentication Service
  • Critical 9.5
    CVE-2026-103510

    Authentication bypass via blank auth token in P4Search

    P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P…

    Perforce P4 (Helix Core)
  • Critical 9.5
    CVE-2026-100102

    RCE via exposed JDWP debug agent in P4Search

    Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the conne…

    Perforce P4 (Helix Core)
  • Critical 9.8
    CVE-2026-85978

    Unauthenticated Remote Code Execution in Akana API Platform

    An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication …

    Perforce Akana
  • Critical 9.0
    CVE-2025-3113

    Improper Access Control in Delphix Masking Engine

    A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leverage the application’s built-in Connector functionality to access Continuous Compliance’s internal database. This allow…

    Perforce Delphix