Skip to content
Palantir vulnerabilities
Newest
-
palantir com.palantir.aries:aries
Authentication bypass in Aries due to misconfiguration
CVE-2025-68609
6.6 Medium
-
palantir com.palantir.acme:dossier-app, com.palantir.acme:gotham-default-apps-bundle, com.palantir.acme:stencil-app-bundle +2 more
Under certain configurations, file artifacts uploaded to the Dossier and Slides apps did not inherit security markings of their parent artifact. This lack of security markings could lead to unintended…
CVE-2025-62487
3.5 Low
-
palantir com.palantir.acme.gaia:gaia
Gaia unauthenticated endpoints
CVE-2023-30971
6.8 Medium
-
palantir com.palantir.gotham:glutton
Glutton V1 endpoints missing authentication
CVE-2024-49587
9.1 Critical
-
palantir com.palantir.codeassist2:code-assist-proxy, com.palantir.compute:compute-service +1 more
Network boundaries not respected in certain Foundry namespaces.
CVE-2025-53710
7.5 High
-
palantir com.palantir.controlpanel:control-panel
Insufficient permission checks when pre-enrolling users Summary
CVE-2025-64400
4.1 Medium
-
palantir com.palantir.secupload:secure-upload
Access control issues impacting secure-upload service
CVE-2025-53709
5.4 Medium
-
palantir com.palantir.artifacts:artifacts
Foundry artifacts denial of service
CVE-2024-49589
6.5 Medium
-
palantir com.palantir.gotham:external-artifacts
Access control issue impacting RV backed objects
CVE-2024-49581
6.5 Medium
-
oracle oracle-sidecar, palantir com.palantir.srx.prometheus.sls-oracle-sidecar:sls-oracle-sidecar +1 more
Multiple authenticated SQL injections in oracle-sidecar
CVE-2024-49588
6.8 Medium
-
palantir com.palantir.acme.gaia:gaia
Stored XSS in gaia
CVE-2023-30968
6.8 Medium
-
guardiansoft guardian, palantir com.palantir.skywise:guardian +1 more
In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes the linter name from the default value, the renamed value may be visible to the rest of the stack’s…
CVE-2023-22836
3.5 Low
-
palantir com.palantir.gotham:blackbird-witchcraft, gotham blackbird-witchcraft, gotham static-assets-servlet +2 more
Gotham table and Forward App Path traversal
CVE-2023-30970
6.5 Medium
-
palantir video-application-server, com.palantir.video:video-application-server +1 more
Gotham Video Broken Authentication
CVE-2023-30954
2.7 Low
-
palantir orbital simulator, com.palantir.meta:orbital-simulator +1 more
Gotham Orbital Simulator path traversal
CVE-2023-30967
9.8 Critical
-
palantir tiles, com.palantir.tiles:tiles +1 more
Palantir Tiles missing authentication on API endpoints
CVE-2023-30969
8.2 High
-
palantir com.palantir.acme:gotham-fe-bundle, com.palantir.acme:titanium-browser-app-bundle, gotham-fe-bundle +1 more +3 more
Palantir Gotham UI bug that could lead to incorrect data classification
CVE-2023-30961
6.5 Medium
-
palantir apollo autopilot, com.palantir.apollo:autopilot +1 more
Stored XSS via javascript URI in Apollo Change Requests comment
CVE-2023-30959
4.1 Medium
-
palantir gotham cerberus, com.palantir.acme.cerberus:cerberus +1 more
Stored XSS in cerberus attachments
CVE-2023-30962
6.8 Medium
-
palantir foundry, com.palantir.foundry:foundry-frontend +1 more
Foundry Issues reporterPath phishing by parameter injection
CVE-2023-30952
5.0 Medium
-
palantir foundry campaigns, com.palantir.campaigns:campaigns +1 more
CVE-2023-30950
CVE-2023-30950
6.5 Medium
-
zabbix frontend, palantir com.palantir.foundry:foundry-frontend +1 more
DOM XSS in Developer mode dashboard via redirect GET parameter
CVE-2023-30958
4.7 Medium
-
palantir com.palantir.magritte:magritte-rest-source-bundle, magritte-rest-source-bundle +1 more
CVE-2023-30951
CVE-2023-30951
6.3 Medium
-
palantir slate, com.palantir.slate:slate +1 more
CVE-2023-30949
CVE-2023-30949
4.3 Medium
-
palantir foundry comments, com.palantir.comments:comments +1 more
IDOR in Foundry Comments allows retrieval of attachments
CVE-2023-30956
5.3 Medium
-
palantir foundry job-tracker, com.palantir.foundry.jobtracker:job-tracker +1 more
Insecure Direct Object Reference (IDOR) in Foundry job-tracker
CVE-2023-30960
4.3 Medium
-
palantir foundry frontend, com.palantir.foundry:foundry-frontend +1 more
Stored XSS in Foundry Slate Query Dropdown menu
CVE-2023-30963
5.4 Medium
-
palantir foundry frontend, foundry issues, com.palantir.foundry:foundry-frontend +1 more +3 more
Denial of Service in Foundry Issues
CVE-2023-22835
7.7 High
-
palantir foundry issues, com.palantir.issues:issues +1 more
Issues notification metadata lacks authorization
CVE-2023-30946
3.5 Low
-
palantir foundry workspace-server, com.palantir.workspace:workspace +1 more
Foundry workspace-server Developer Mode Authorization Bypass
CVE-2023-30955
4.3 Medium
-
palantir contour, com.palantir.contour:contour-dispatch +1 more
The contour service was not checking that users had permission to create an analysis for a given dataset
CVE-2023-22834
2.7 Low
-
palantir clips2, video clip distributor, com.palantir.gotham:clips2 +3 more +5 more
CVE-2023-30945
CVE-2023-30945
9.8 Critical
-
palantir foundry, com.palantir.lime:lime2 +1 more
Mandatory control bypass in Lime2
CVE-2023-22833
7.6 High
-
palantir foundry comments, com.palantir.comments:comments +1 more
Retrieval of Attachments to Comments lacks Authorization
CVE-2023-30948
6.5 Medium
-
palantir sls-logging
It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a...
CVE-2022-48308
6.3 Medium
-
palantir magritte-ftp, foundry magritte +1 more
It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a...
CVE-2022-48307
6.3 Medium
-
palantir gotham chat irc, gotham chat irc helper +1 more
Gotham Chat IRC help does not validate hostnames in TLS certificates
CVE-2022-48306
5.7 Medium
-
palantir gotham
Palantir Gotham included an endpoint that would log arbitrary sized zip files.
CVE-2022-27897
5.3 Medium
-
palantir gotham
Palantir Gotham included an endpoint that would log arbitrary sized payloads.
CVE-2022-27892
5.3 Medium
-
palantir gotham
Palantir Gotham included an unauthenticated endpoint that listed all active usernames in the platform with an active session.
CVE-2022-27891
5.3 Medium
-
palantir atlasdb
It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a...
CVE-2022-27890
6.3 Medium
-
palantir foundry build2
A component in Foundry logging was found to be capturing sensitive information in logs.
CVE-2022-27895
4.2 Medium
-
palantir foundry code-workbooks
The Foundry Code-Workbooks service was found to contain an issue leading to information disclosure.
CVE-2022-27896
4.2 Medium
-
palantir foundry blobster service, foundry blobster +1 more
The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability.
CVE-2022-27894
4.8 Medium
-
osisoft-pi-web-connector project osisoft-pi-web-connector, palantir foundry magritte plugin osisoft-pi-web-connector +1 more
The Foundry Magritte plugin osisoft-pi-web-connector was found to be logging in a manner that captured authentication requests.
CVE-2022-27893
4.2 Medium
-
palantir foundry multipass
The Foundry Multipass service contains code paths that could be abused to cause a denial of service for authentication and authorization operations.
CVE-2022-27889
5.3 Medium
-
palantir foundry issues
The Foundry Issues service was found to be logging in a manner that captured session tokens.
CVE-2022-27888
5.5 Medium