Palantir

Latest CVEs · RSS

• CVE-2025-68609 2026-01-22 · CVSS 6.6
  A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default configu
• CVE-2025-62487 2026-01-09 · CVSS 3.5
  On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels.
• CVE-2023-30971 2025-12-19 · CVSS 6.8
  Gotham Gaia application was found to be exposing multiple unauthenticated endpoints.
• CVE-2024-49587 2025-12-19 · CVSS 9.1
  Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glu
• CVE-2025-53710 2025-12-18 · CVSS 7.5
  Due to a product misconfiguration in certain deployment types, it was possible from different pods in the same namespace to communicate with each other. This is
• CVE-2025-64400 2025-12-18 · CVSS 4.1
  Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating users checks that the
• CVE-2025-53709 2025-07-10 · CVSS 5.4
  Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small number
• CVE-2024-49589 2025-02-18 · CVSS 6.5
  Foundry Artifacts was found to be vulnerable to a Denial Of Service attack due to disk being potentially filled up based on an user supplied argument (size).
• CVE-2024-49581 2024-12-02 · CVSS 6.5
  Restricted Views backed objects (OSV1) could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have perm
• CVE-2024-49588 2024-11-21 · CVSS 6.8
  Multiple endpoints in `oracle-sidecar` in versions 0.347.0 to 0.543.0 were found to be vulnerable to SQL injections.
• CVE-2023-30968 2024-03-12 · CVSS 6.8
  One of Gotham Gaia services was found to be vulnerable to a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker to bypass CSP an
• CVE-2023-22836 2024-01-29 · CVSS 3.5
  In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes a group name from the default value, the renamed value may
• CVE-2023-30970 2024-01-29 · CVSS 6.5
  Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file sy
• CVE-2023-30954 2023-11-15 · CVSS 2.7
  The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not ye
• CVE-2023-30967 2023-10-25 · CVSS 9.8
  Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files
• CVE-2023-30969 2023-10-25 · CVSS 8.2
  The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoi
• CVE-2023-30961 2023-09-26 · CVSS 6.5
  Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly cr
• CVE-2023-30959 2023-09-26 · CVSS 4.1
  In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction.
• CVE-2023-30962 2023-09-12 · CVSS 6.8
  The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Gotham to lau
• CVE-2023-30952 2023-08-03 · CVSS 5.0
  A security defect was discovered in Foundry Issues that enabled users to create convincing phishing links by editing the request sent when creating an Issue. Th
• CVE-2023-30950 2023-08-03 · CVSS 6.5
  The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint
• CVE-2023-30958 2023-08-03 · CVSS 4.7
  A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. This defec
• CVE-2023-30951 2023-08-03 · CVSS 6.3
  The Foundry Magritte plugin rest-source was found to be vulnerable to an an XML external Entity attack (XXE).
• CVE-2023-30949 2023-07-26 · CVSS 4.3
  A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks.
• CVE-2023-30956 2023-07-10 · CVSS 5.3
  A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the