https://vulnogram.org/ Most recent CVEs assigned by Palantir Technologies (palantir). https://vulnogram.org/seaview/icons/palantir.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2025-68609 https://vulnogram.org/CVE-2025-68609 A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default configuration. The defect resulted in both authentication and authorization checks being bypassed… Medium Thu, 22 Jan 2026 19:06:05 GMT https://vulnogram.org/CVE-2025-62487 https://vulnogram.org/CVE-2025-62487 On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels. The regression was traced back to a change in May 2025, which was meant to allow file uplo… Low Fri, 09 Jan 2026 21:17:37 GMT https://vulnogram.org/CVE-2023-30971 https://vulnogram.org/CVE-2023-30971 Gotham Gaia application was found to be exposing multiple unauthenticated endpoints. Medium Fri, 19 Dec 2025 16:34:19 GMT https://vulnogram.org/CVE-2024-49587 https://vulnogram.org/CVE-2024-49587 Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched a… Critical Fri, 19 Dec 2025 16:33:22 GMT https://vulnogram.org/CVE-2025-53710 https://vulnogram.org/CVE-2025-53710 Due to a product misconfiguration in certain deployment types, it was possible from different pods in the same namespace to communicate with each other. This issue resulted in bypass of access control due to the presence of a vulnerable endpoint in F… High Thu, 18 Dec 2025 21:05:51 GMT https://vulnogram.org/CVE-2025-64400 https://vulnogram.org/CVE-2025-64400 Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating users checks that the account requesting a user creation has `edit` on the enrollment-level user directory, but… Medium Thu, 18 Dec 2025 19:32:30 GMT https://vulnogram.org/CVE-2025-53709 https://vulnogram.org/CVE-2025-53709 Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small number of environments. Under specific circumstances, privileged users of secure-upload could ha… Medium Thu, 10 Jul 2025 18:38:31 GMT https://vulnogram.org/CVE-2024-49589 https://vulnogram.org/CVE-2024-49589 Foundry Artifacts was found to be vulnerable to a Denial Of Service attack due to disk being potentially filled up based on an user supplied argument (size). Medium Tue, 18 Feb 2025 17:18:41 GMT https://vulnogram.org/CVE-2024-49581 https://vulnogram.org/CVE-2024-49581 Restricted Views backed objects (OSV1) could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have permission to see such objects to view them via Object Explorer directly. This software bug di… Medium Mon, 02 Dec 2024 20:26:15 GMT https://vulnogram.org/CVE-2024-49588 https://vulnogram.org/CVE-2024-49588 Multiple endpoints in `oracle-sidecar` in versions 0.347.0 to 0.543.0 were found to be vulnerable to SQL injections. Medium Thu, 21 Nov 2024 19:59:45 GMT https://vulnogram.org/CVE-2023-30968 https://vulnogram.org/CVE-2023-30968 One of Gotham Gaia services was found to be vulnerable to a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker to bypass CSP and get a persistent cross site scripting payload on the stack. Medium Tue, 12 Mar 2024 19:39:24 GMT https://vulnogram.org/CVE-2023-22836 https://vulnogram.org/CVE-2023-22836 In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes a group name from the default value, the renamed value may be visible to the rest of the stack’s tenants. Low Mon, 29 Jan 2024 18:50:37 GMT https://vulnogram.org/CVE-2023-30970 https://vulnogram.org/CVE-2023-30970 Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file system. Medium Mon, 29 Jan 2024 18:27:26 GMT https://vulnogram.org/CVE-2023-30954 https://vulnogram.org/CVE-2023-30954 The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not yet initialized. Low Wed, 15 Nov 2023 19:43:36 GMT https://vulnogram.org/CVE-2023-30967 https://vulnogram.org/CVE-2023-30967 Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files on the file system. Critical Wed, 25 Oct 2023 23:18:23 GMT https://vulnogram.org/CVE-2023-30969 https://vulnogram.org/CVE-2023-30969 The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints. High Wed, 25 Oct 2023 23:16:06 GMT https://vulnogram.org/CVE-2023-30961 https://vulnogram.org/CVE-2023-30961 Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly created property or link. Medium Tue, 26 Sep 2023 18:01:07 GMT https://vulnogram.org/CVE-2023-30959 https://vulnogram.org/CVE-2023-30959 In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction. Medium Tue, 26 Sep 2023 17:56:20 GMT https://vulnogram.org/CVE-2023-30962 https://vulnogram.org/CVE-2023-30962 The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Gotham to launch attacks against other users. This vulnerability is resolved in Cerberus 100.230704.0-2… Medium Tue, 12 Sep 2023 18:29:42 GMT https://vulnogram.org/CVE-2023-30952 https://vulnogram.org/CVE-2023-30952 A security defect was discovered in Foundry Issues that enabled users to create convincing phishing links by editing the request sent when creating an Issue. This defect was resolved in Frontend release 6.228.0 . Medium Thu, 03 Aug 2023 21:12:53 GMT https://vulnogram.org/CVE-2023-30950 https://vulnogram.org/CVE-2023-30950 The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint Medium Thu, 03 Aug 2023 21:10:15 GMT https://vulnogram.org/CVE-2023-30958 https://vulnogram.org/CVE-2023-30958 A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.225.0. Medium Thu, 03 Aug 2023 21:09:10 GMT https://vulnogram.org/CVE-2023-30951 https://vulnogram.org/CVE-2023-30951 The Foundry Magritte plugin rest-source was found to be vulnerable to an an XML external Entity attack (XXE). Medium Thu, 03 Aug 2023 21:07:11 GMT https://vulnogram.org/CVE-2023-30949 https://vulnogram.org/CVE-2023-30949 A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks. Medium Wed, 26 Jul 2023 17:35:04 GMT https://vulnogram.org/CVE-2023-30956 https://vulnogram.org/CVE-2023-30956 A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foun… Medium Mon, 10 Jul 2023 21:07:31 GMT https://vulnogram.org/CVE-2023-30960 https://vulnogram.org/CVE-2023-30960 A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was rolled out to a… Medium Mon, 10 Jul 2023 21:05:23 GMT https://vulnogram.org/CVE-2023-30963 https://vulnogram.org/CVE-2023-30963 A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.229.0. The service was rolled out to… Medium Mon, 10 Jul 2023 21:04:08 GMT https://vulnogram.org/CVE-2023-22835 https://vulnogram.org/CVE-2023-22835 A security defect was identified that enabled a user of Foundry Issues to perform a Denial of Service attack by submitting malformed data in an Issue that caused loss of frontend functionality to all issue participants. This defect was resolved with… High Mon, 10 Jul 2023 20:58:14 GMT https://vulnogram.org/CVE-2023-30946 https://vulnogram.org/CVE-2023-30946 A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue includ… Low Thu, 29 Jun 2023 18:49:23 GMT https://vulnogram.org/CVE-2023-30955 https://vulnogram.org/CVE-2023-30955 A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'. This enabled users with insufficient privilege the ability to view and interact with Deve… Medium Thu, 29 Jun 2023 18:46:33 GMT https://vulnogram.org/CVE-2023-22834 https://vulnogram.org/CVE-2023-22834 The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass folders with extraneous analyses, that the attacker would otherwise not have permission to cr… Low Mon, 26 Jun 2023 23:06:00 GMT https://vulnogram.org/CVE-2023-30945 https://vulnogram.org/CVE-2023-30945 Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A malicious at… Critical Mon, 26 Jun 2023 23:00:08 GMT https://vulnogram.org/CVE-2023-22833 https://vulnogram.org/CVE-2023-22833 Palantir Foundry deployments running Lime2 versions between 2.519.0 and 2.532.0 were vulnerable a bug that allowed authenticated users within a Foundry organization to bypass discretionary or mandatory access controls under certain circumstances. High Tue, 06 Jun 2023 18:55:06 GMT https://vulnogram.org/CVE-2023-30948 https://vulnogram.org/CVE-2023-30948 A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks. This could enable an authenticated user to inject a prior discovered attachment UUID into o… Medium Tue, 06 Jun 2023 14:12:59 GMT https://vulnogram.org/CVE-2022-48308 https://vulnogram.org/CVE-2022-48308 It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle at… Medium Thu, 16 Feb 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-48307 https://vulnogram.org/CVE-2022-48307 It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle a… Medium Thu, 16 Feb 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-48306 https://vulnogram.org/CVE-2022-48306 Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-… Medium Thu, 16 Feb 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-27897 https://vulnogram.org/CVE-2022-27897 Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attacker could repeatedly upload a malicious zip file, which would allow them to exhaust memory r… Medium Network Exploitable Thu, 16 Feb 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-27892 https://vulnogram.org/CVE-2022-27892 Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispatch service. Medium Network Exploitable Thu, 16 Feb 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-27891 https://vulnogram.org/CVE-2022-27891 Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected services have been patched and automatically deployed to all Apollo-managed Gotham instances. It is highly recomme… Medium Network Exploitable Thu, 16 Feb 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-27890 https://vulnogram.org/CVE-2022-27890 It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle at… Medium Thu, 16 Feb 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-27895 https://vulnogram.org/CVE-2022-27895 Information Exposure Through Log Files vulnerability discovered in Foundry when logs were captured using an underlying library known as Build2. This issue was present in versions earlier than 1.785.0. Upgrade to Build2 version 1.785.0 or greater. Medium Tue, 15 Nov 2022 19:45:12 GMT https://vulnogram.org/CVE-2022-27896 https://vulnogram.org/CVE-2022-27896 Information Exposure Through Log Files vulnerability discovered in Foundry Code-Workbooks where the endpoint backing that console was generating service log records of any Python code being run. These service logs included the Foundry token that repr… Medium Mon, 14 Nov 2022 20:55:11 GMT https://vulnogram.org/CVE-2022-27894 https://vulnogram.org/CVE-2022-27894 The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Foundry to launch attacks against other users. This vulnerability is resolved in Blobster 3.228.0. Medium Fri, 04 Nov 2022 17:15:11 GMT https://vulnogram.org/CVE-2022-27893 https://vulnogram.org/CVE-2022-27893 The Foundry Magritte plugin osisoft-pi-web-connector versions 0.15.0 - 0.43.0 was found to be logging in a manner that captured authentication requests. This vulnerability is resolved in osisoft-pi-web-connector version 0.44.0. Medium Fri, 04 Nov 2022 16:05:08 GMT https://vulnogram.org/CVE-2022-27889 https://vulnogram.org/CVE-2022-27889 The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations. A malicious attacker could perform an application-level denial of service attack, potentially causing… Medium Network Exploitable Tue, 14 Jun 2022 13:45:14 GMT https://vulnogram.org/CVE-2022-27888 https://vulnogram.org/CVE-2022-27888 Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fixed in 2.249.1. Medium Tue, 26 Apr 2022 22:35:08 GMT