Skip to content
Sign in

Vendor

Perforce

Alert
No Perforce CVE is in the CISA KEV catalogue.

Tracked since 5 Oct · latest article 5 Oct · RSS · API

That product is not in Perforce’s coverage, so the whole vendor is shown.

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 0 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

1Articles · 7 days

usual rate

Exploited, by due date

No Perforce CVE is in the CISA KEV catalogue.

Patch cadence and exploit odds

How often CISA adds Perforce CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

CISA has not added a Perforce CVE to KEV.

Fix listed

6 of 6 CVEs in coverage

Every CVE in coverage has a fix recorded.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-103507: 43.8th percentileCVE-2026-100103: 36.7th percentileCVE-2026-103510: 32.1th percentileCVE-2026-103512: 31.4th percentileCVE-2026-100102: 29.5th percentileCVE-2026-103511: 25.9th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-10350743.8
CVE-2026-10010336.7
CVE-2026-10351032.1
CVE-2026-10351231.4
CVE-2026-10010229.5
CVE-2026-10351125.9

Coverage1 article · all time

The latest 2 articles naming Perforce, in the shared story grammar.

Full timeline
Developinglatest 2 hours ago2 articles1 outlet

2 articles from 1 outlet since 5 Oct. Picked up again today after 4 weeks quiet.

Now5 Oct4 NovFirst reportSecurityOnline · 5 Oct, 09:58Picked up againafter 4 weeks quiet
  • Mon 5 Oct, 09:58 UTC. SecurityOnline, first report. Perforce P4 Search Flaws Let Attackers Seize Unprotected Services.
  • Wed 4 Nov, 03:31 UTC. SecurityOnline. PoC exposes critical remote code flaw in Puppet Server.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 2 articles as a list
  1. Mon 5 OctDay 01
    1. Perforce P4 Search Flaws Let Attackers Seize Unprotected Services09:58 · SecurityOnline · First report

  2. Quiet for 4 weeks

    Wed 4 NovDay 301
    1. PoC exposes critical remote code flaw in Puppet Server03:31 · SecurityOnline · Picked up again

All CVEs in coverage6

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-103507

    Arbitrary file-write via log configuration path in P4Search

    7.5High0.5% EPSS · 1 article
  • CVE-2026-100103

    Authentication bypass via default auth token in P4Search

    10.0Critical0.4% EPSS · 1 article
  • CVE-2026-103510

    Authentication bypass via blank auth token in P4Search

    9.5Critical0.4% EPSS · 1 article
  • CVE-2026-103512

    Ticket host-binding bypass via spoofed client IP in P4Search

    5.3Medium0.4% EPSS · 1 article
  • CVE-2026-100102

    RCE via exposed JDWP debug agent in P4Search

    9.5Critical0.4% EPSS · 1 article
  • CVE-2026-103511

    Arbitrary file-write via extension installation in P4Search

    5.1Medium0.3% EPSS · 1 article
  • CVE-2026-115732

    Certificate Name Authorization Bypass

    9.0Critical1 article
  • CVE-2026-115731

    Report Deserialization Code Execution

    9.4Critical1 article
CyberSIXTSignal over noise
Updated AboutDevelopersSign in