Palantir vulnerabilities
47 CVEs and advisories name Palantir as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-68609Authentication bypass in Aries due to misconfiguration
- CVE-2025-62487Under certain configurations, file artifacts uploaded to the Dossier and Slides apps did not inherit security markings of their parent artifact. This lack of security markings could lead to unintended access to the uploaded files.
- CVE-2023-30971Gaia unauthenticated endpoints
- CVE-2024-49587Glutton V1 endpoints missing authentication
- CVE-2025-53710Network boundaries not respected in certain Foundry namespaces.
- CVE-2025-64400Insufficient permission checks when pre-enrolling users Summary
- CVE-2025-53709Access control issues impacting secure-upload service
- CVE-2024-49589Foundry artifacts denial of service
- CVE-2024-49581Access control issue impacting RV backed objects
- CVE-2024-49588Multiple authenticated SQL injections in oracle-sidecar
- CVE-2023-30968Stored XSS in gaia
- CVE-2023-22836In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes the linter name from the default value, the renamed value may be visible to the rest of the stack’s tenants.
- CVE-2023-30970Gotham table and Forward App Path traversal
- CVE-2023-30954Gotham Video Broken Authentication
- CVE-2023-30967Gotham Orbital Simulator path traversal
- CVE-2023-30969Palantir Tiles missing authentication on API endpoints
- CVE-2023-30961Palantir Gotham UI bug that could lead to incorrect data classification
- CVE-2023-30959Stored XSS via javascript URI in Apollo Change Requests comment
- CVE-2023-30962Stored XSS in cerberus attachments
- CVE-2023-30952Foundry Issues reporterPath phishing by parameter injection
- CVE-2023-30950CVE-2023-30950
- CVE-2023-30958DOM XSS in Developer mode dashboard via redirect GET parameter
- CVE-2023-30951CVE-2023-30951
- CVE-2023-30949CVE-2023-30949
- CVE-2023-30956IDOR in Foundry Comments allows retrieval of attachments
- CVE-2023-30960Insecure Direct Object Reference (IDOR) in Foundry job-tracker
- CVE-2023-30963Stored XSS in Foundry Slate Query Dropdown menu
- CVE-2023-22835Denial of Service in Foundry Issues
- CVE-2023-30946Issues notification metadata lacks authorization
- CVE-2023-30955Foundry workspace-server Developer Mode Authorization Bypass