Palantir vulnerabilities | LiveThreat CVE Feed

CVE	Product	CVSS	EPSS	Published	Summary
CVE-2025-62487	CO com.palantir.acme:dossier-app Palantir	3.5	0%	Jan 9	Under certain configurations, file artifacts uploaded to the Dossier and Slides apps did not inherit security markings of their parent artifact. This lack of security markings could lead to unintended access to the uploaded files.
CVE-2025-64400	CO com.palantir.controlpanel:control-panel Palantir	4.1	0%	Dec 18	Insufficient permission checks when pre-enrolling users Summary
CVE-2025-53709	CO com.palantir.secupload:secure-upload Palantir	5.4	0%	Jul 10	Access control issues impacting secure-upload service
CVE-2024-49589	CO com.palantir.artifacts:artifacts Palantir	6.5	1%	Feb 18	Foundry artifacts denial of service
CVE-2024-49581	CO com.palantir.gotham:external-artifacts Palantir	6.5	0%	Dec 2	Access control issue impacting RV backed objects
CVE-2024-49588	CO com.palantir.srx.prometheus.sls-oracle-sidecar:sls-oracle-sidecar Palantir	6.8	0%	Nov 21	Multiple authenticated SQL injections in oracle-sidecar
CVE-2023-22836	CO com.palantir.skywise:guardian Palantir	5.4	0%	Jan 29	In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes the linter name from the default value, the renamed value may be visible to the rest of the stack’s tenants.
CVE-2023-30970	CO com.palantir.gotham:blackbird-witchcraft Palantir	6.5	1%	Jan 29	Gotham table and Forward App Path traversal
CVE-2023-30954	CO com.palantir.video:video-application-server Palantir	3.7	0%	Nov 15	Gotham Video Broken Authentication
CVE-2023-30967	CO com.palantir.meta:orbital-simulator Palantir	7.5	1%	Oct 25	Gotham Orbital Simulator path traversal
CVE-2023-30969	CO com.palantir.tiles:tiles Palantir	6.5	0%	Oct 25	Palantir Tiles missing authentication on API endpoints
CVE-2023-30961	CO com.palantir.acme:titanium-browser-app-bundle Palantir	6.1	0%	Sep 26	Palantir Gotham UI bug that could lead to incorrect data classification
CVE-2023-30959	CO com.palantir.apollo:autopilot Palantir	5.4	0%	Sep 26	Stored XSS via javascript URI in Apollo Change Requests comment
CVE-2023-30962	CO com.palantir.acme.cerberus:cerberus Palantir	5.4	0%	Sep 12	Stored XSS in cerberus attachments
CVE-2023-30952	FO Foundry Palantir	4.3	0%	Aug 3	Foundry Issues reporterPath phishing by parameter injection
CVE-2023-30950	CO com.palantir.campaigns:campaigns Palantir	5.9	0%	Aug 3	No description published yet
CVE-2023-30958	CO com.palantir.foundry:foundry-frontend Palantir	6.1	0%	Aug 3	DOM XSS in Developer mode dashboard via redirect GET parameter
CVE-2023-30951	CO com.palantir.magritte:magritte-rest-source-bundle Palantir	6.5	0%	Aug 3	No description published yet
CVE-2023-30949	CO com.palantir.slate:slate Palantir	5.3	0%	Jul 26	No description published yet
CVE-2023-30956	CO com.palantir.comments:comments Palantir	5.3	0%	Jul 10	IDOR in Foundry Comments allows retrieval of attachments
CVE-2023-30960	CO com.palantir.foundry.jobtracker:job-tracker Palantir	4.3	0%	Jul 10	Insecure Direct Object Reference (IDOR) in Foundry job-tracker
CVE-2023-30963	CO com.palantir.foundry:foundry-frontend Palantir	5.4	0%	Jul 10	Stored XSS in Foundry Slate Query Dropdown menu
CVE-2023-22835	CO com.palantir.foundry:foundry-frontend Palantir	7.7	1%	Jul 10	Denial of Service in Foundry Issues
CVE-2023-30946	CO com.palantir.issues:issues Palantir	4.3	0%	Jun 29	Issues notification metadata lacks authorization
CVE-2023-30955	CO com.palantir.workspace:workspace Palantir	5.4	0%	Jun 29	Foundry workspace-server Developer Mode Authorization Bypass
CVE-2023-22834	CO com.palantir.contour:contour-dispatch Palantir	4.3	0%	Jun 26	The contour service was not checking that users had permission to create an analysis for a given dataset
CVE-2023-30945	CO com.palantir.video:video-clip-distributor Palantir	9.8	1%	Jun 26	No description published yet
CVE-2023-22833	CO com.palantir.lime:lime2 Palantir	6.5	0%	Jun 6	Mandatory control bypass in Lime2
CVE-2023-30948	CO com.palantir.comments:comments Palantir	6.5	1%	Jun 6	Retrieval of Attachments to Comments lacks Authorization
CVE-2022-27891	GO Gotham Palantir	5.3	0%	Feb 16	Palantir Gotham included an unauthenticated endpoint that listed all active usernames in the platform with an active session.
CVE-2022-48308	SL sls-logging Palantir	3.7	0%	Feb 16	It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API
CVE-2022-48307	FM Foundry Magritte Palantir	3.7	0%	Feb 16	It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API
CVE-2022-48306	PG Palantir Gotham Chat IRC helper Palantir	6.8	0%	Feb 16	Gotham Chat IRC help does not validate hostnames in TLS certificates
CVE-2022-27897	GO Gotham Palantir	7.5	1%	Feb 16	Palantir Gotham included an endpoint that would log arbitrary sized zip files.
CVE-2022-27892	GO Gotham Palantir	7.5	1%	Feb 16	Palantir Gotham included an endpoint that would log arbitrary sized payloads.
CVE-2022-27890	AT AtlasDB Palantir	7.4	0%	Feb 16	It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API
CVE-2022-27895	FB Foundry Build2 Palantir	7.5	0%	Nov 15	A component in Foundry logging was found to be capturing sensitive information in logs.
CVE-2022-27896	FC Foundry Code-Workbooks Palantir	7.5	0%	Nov 14	The Foundry Code-Workbooks service was found to contain an issue leading to information disclosure.
CVE-2022-27894	FB Foundry Blobster Service Palantir	5.4	0%	Nov 4	The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability.
CVE-2022-27893	FM Foundry Magritte plugin osisoft-pi-web-connector Palantir	4.2	0%	Nov 4	The Foundry Magritte plugin osisoft-pi-web-connector was found to be logging in a manner that captured authentication requests.
CVE-2022-27889	FM Foundry Multipass Palantir	9.1	1%	Jun 14	The Foundry Multipass service contains code paths that could be abused to cause a denial of service for authentication and authorization operations.
CVE-2022-27888	FI Foundry Issues Palantir	5.5	0%	Apr 26	The Foundry Issues service was found to be logging in a manner that captured session tokens.