Palantir vulnerabilities | LiveThreat CVE Feed

CVE	Product	CVSS	EPSS	Published	Summary
CVE-2025-62487	CO com.palantir.acme:gotham-default-apps-bundle Palantir	3.5	0%	Jan 9	Under certain configurations, file artifacts uploaded to the Dossier and Slides apps did not inherit security markings of their parent artifact. This lack of security markings could lead to unintended access to the uploaded files.
CVE-2025-64400	CO com.palantir.controlpanel:control-panel Palantir	4.1	0%	Dec 18	Insufficient permission checks when pre-enrolling users Summary
CVE-2025-53709	CO com.palantir.secupload:secure-upload Palantir	5.4	0%	Jul 10	Access control issues impacting secure-upload service
CVE-2024-49589	CO com.palantir.artifacts:artifacts Palantir	6.5	1%	Feb 18	Foundry artifacts denial of service
CVE-2024-49581	CO com.palantir.gotham:external-artifacts Palantir	6.5	0%	Dec 2	Access control issue impacting RV backed objects
CVE-2024-49588	CO com.palantir.srx.prometheus.sls-oracle-sidecar:sls-oracle-sidecar Palantir	6.8	0%	Nov 21	Multiple authenticated SQL injections in oracle-sidecar
CVE-2023-30970	GB Gotham Blackbird-witchcraft Palantir	6.5	1%	Jan 29	Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file system
CVE-2023-30954	VI Video-application-server Palantir	3.7	0%	Nov 15	The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not yet initialized
CVE-2023-30969	TI Tiles Palantir	6.5	0%	Oct 26	The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints
CVE-2023-30967	OS Orbital Simulator Palantir	7.5	1%	Oct 26	Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files on the file system
CVE-2023-30961	TI Titanium-browser-app-bundle Palantir	6.1	0%	Sep 27	Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly created property or…
CVE-2023-30959	AA Apollo Autopilot Palantir	5.4	0%	Sep 27	In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction
CVE-2023-30962	GC Gotham Cerberus Palantir	5.4	0%	Sep 12	The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Gotham to launch attacks against…
CVE-2023-30952	FO Foundry Palantir	4.3	0%	Aug 3	A security defect was discovered in Foundry Issues that enabled users to create convincing phishing links by editing the request sent when creating an Issue
CVE-2023-30951	MA Magritte-rest-source-bundle Palantir	6.5	0%	Aug 3	The Foundry Magritte plugin rest-source was found to be vulnerable to an an XML external Entity attack (XXE)
CVE-2023-30950	FC Foundry Campaigns Palantir	5.9	0%	Aug 3	The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint
CVE-2023-30949	SL Slate Palantir	5.3	0%	Jul 26	A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks
CVE-2023-30963	FF Foundry Frontend Palantir	5.4	0%	Jul 10	A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be bypassed
CVE-2023-30960	FJ Foundry Job-tracker Palantir	4.3	0%	Jul 10	A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to
CVE-2023-30956	FC Foundry Comments Palantir	5.3	0%	Jul 10	A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of…
CVE-2023-22835	FI Foundry Issues Palantir	7.7	1%	Jul 10	A security defect was identified that enabled a user of Foundry Issues to perform a Denial of Service attack by submitting malformed data in an Issue that caused loss of frontend…
CVE-2023-30955	FW Foundry Workspace-server Palantir	5.4	0%	Jun 29	A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'
CVE-2023-30946	FI Foundry Issues Palantir	4.3	0%	Jun 29	A security defect was identified in Foundry Issues
CVE-2023-22834	CO Contour Palantir	4.3	0%	Jun 27	The Contour Service was not checking that users had permission to create an analysis for a given dataset
CVE-2023-30945	VC Video Clip Distributor Palantir	9.8	1%	Jun 26	Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write…
CVE-2023-22833	FO Foundry Palantir	6.5	0%	Jun 6	Palantir Foundry deployments running Lime2 versions between 2.519.0 and 2.532.0 were vulnerable a bug that allowed authenticated users within a Foundry organization to bypass…
CVE-2023-30948	FC Foundry Comments Palantir	6.5	1%	Jun 6	A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks
CVE-2022-48308	SL Sls-logging Palantir	3.7	0%	Feb 16	It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API
CVE-2022-48307	MA Magritte-ftp Palantir	3.7	0%	Feb 16	It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API
CVE-2022-48306	GC Gotham Chat Irc Palantir	6.8	0%	Feb 16	Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker in a privileged network position could…
CVE-2022-27897	GO Gotham Palantir	7.5	1%	Feb 16	Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory
CVE-2022-27892	GO Gotham Palantir	7.5	1%	Feb 16	Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispatch service
CVE-2022-27891	GO Gotham Palantir	5.3	0%	Feb 16	Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session
CVE-2022-27890	AT Atlasdb Palantir	7.4	0%	Feb 16	It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API
CVE-2022-27895	FB Foundry Build2 Palantir	7.5	0%	Nov 15	Information Exposure Through Log Files vulnerability discovered in Foundry when logs were captured using an underlying library known as Build2
CVE-2022-27896	FC Foundry Code-workbooks Palantir	7.5	0%	Nov 14	Information Exposure Through Log Files vulnerability discovered in Foundry Code-Workbooks where the endpoint backing that console was generating service log records of any Python…
CVE-2022-27894	FB Foundry Blobster Service Palantir	5.4	0%	Nov 4	The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability.
CVE-2022-27893	FM Foundry Magritte plugin osisoft-pi-web-connector Palantir	4.2	0%	Nov 4	The Foundry Magritte plugin osisoft-pi-web-connector was found to be logging in a manner that captured authentication requests.
CVE-2022-27889	FM Foundry Multipass Palantir	9.1	1%	Jun 14	The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations
CVE-2022-27888	FI Foundry Issues Palantir	5.5	0%	Apr 26	Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens)