Perforce maintains a focused but strategically important portfolio of version-control, API-management, and data-compliance products that are deeply embedded in enterprise software-development and DevOps infrastructure. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity, and a moderate tendency toward public exploit availability; the products' roles in code repositories, API gateways, and compliance pipelines make their security posture a supply-chain concern. The exposure recurs across flagship products such as Perforce Server, Helix Core, and Akana API through weakness classes including improper input validation, sensitive-information disclosure, resource-exhaustion flaws, code injection, and XML external entity (XXE) issues that reflect the parsing, authentication, and data-handling demands of integration-heavy enterprise middleware. Defenders should prioritize patching this vendor's offerings, particularly internet-reachable instances, given their role in controlling access to source code and managing API security. Current exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Perforce over time
Signals from CVEs in this vendor scope (29 CVEs).
29 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-45849CRITICAL An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2. Reported by Jason Geffner.
| Nov 8, 2023 | 9.8 | 31 | NO | NO |
CVE-2008-1303MEDIUM The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a missing parameter to the (1) d | Mar 12, 2008 | 5.0 | 27 | NO | YES |
CVE-2024-3930CRITICAL In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered. | Jul 30, 2024 | 9.8 | 25 | NO | NO |
CVE-2013-1410MEDIUM Perforce P4web 2011.1 and 2012.1 has multiple XSS vulnerabilities | Feb 12, 2020 | 6.1 | 25 | NO | YES |
CVE-2015-8965CRITICAL Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administratio | Apr 6, 2017 | 9.8 | 25 | NO | NO |
CVE-2007-0100HIGH The Perforce client does not restrict the set of files that it overwrites upon receiving a request from the server, which allows remote attackers to overwrite arbitrary files by mo | Jan 8, 2007 | 10.0 | 25 | NO | NO |
CVE-2025-14591HIGH In Delphix Continuous Compliance version 2025.3.0 and later, following a recent bug fix to correctly handle CR+LF (Windows and DOS) End-of-Record (EOR) characters in delimited file | Dec 20, 2025 | 7.5 | 24 | NO | NO |
CVE-2023-5759HIGH In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the buffer was identified. Reported by Jason Geffner.
| Nov 8, 2023 | 7.5 | 23 | NO | NO |
CVE-2023-45319HIGH In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was identified. Reported by Jason Geffner.
| Nov 8, 2023 | 7.5 | 23 | NO | NO |
CVE-2024-0325HIGH In Helix Sync versions prior to 2024.1, a local command injection was identified. Reported by Bryan Riggins.
| Feb 1, 2024 | 7.8 | 22 | NO | NO |
Signals from CVEs in this vendor scope (29 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Perforce.
Media articles that mention a CVE ID that affects a product developed by Perforce — matched by CVE ID, not by vendor name.