# cve.now: Palantir

The newest entries naming Palantir as an affected vendor (up to 200), of 47 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-68609](https://cve.now/CVE-2025-68609.md): Authentication bypass in Aries due to misconfiguration (CVSS 6.6)
- [CVE-2025-62487](https://cve.now/CVE-2025-62487.md): Under certain configurations, file artifacts uploaded to the Dossier and Slides apps did not inherit security markings of their parent artifact. This lack of security markings could lead to unintended access to the uploaded files. (CVSS 3.5)
- [CVE-2023-30971](https://cve.now/CVE-2023-30971.md): Gaia unauthenticated endpoints (CVSS 6.8)
- [CVE-2024-49587](https://cve.now/CVE-2024-49587.md): Glutton V1 endpoints missing authentication (CVSS 9.1)
- [CVE-2025-53710](https://cve.now/CVE-2025-53710.md): Network boundaries not respected in certain Foundry namespaces. (CVSS 7.5)
- [CVE-2025-64400](https://cve.now/CVE-2025-64400.md): Insufficient permission checks when pre-enrolling users Summary (CVSS 4.1)
- [CVE-2025-53709](https://cve.now/CVE-2025-53709.md): Access control issues impacting secure-upload service (CVSS 5.4)
- [CVE-2024-49589](https://cve.now/CVE-2024-49589.md): Foundry artifacts denial of service (CVSS 6.5)
- [CVE-2024-49581](https://cve.now/CVE-2024-49581.md): Access control issue impacting RV backed objects (CVSS 6.5)
- [CVE-2024-49588](https://cve.now/CVE-2024-49588.md): Multiple authenticated SQL injections in oracle-sidecar (CVSS 6.8)
- [CVE-2023-30968](https://cve.now/CVE-2023-30968.md): Stored XSS in gaia (CVSS 6.8)
- [CVE-2023-22836](https://cve.now/CVE-2023-22836.md): In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes the linter name from the default value, the renamed value may be visible to the rest of the stack’s tenants. (CVSS 3.5)
- [CVE-2023-30970](https://cve.now/CVE-2023-30970.md): Gotham table and Forward App Path traversal (CVSS 6.5)
- [CVE-2023-30954](https://cve.now/CVE-2023-30954.md): Gotham Video Broken Authentication (CVSS 2.7)
- [CVE-2023-30967](https://cve.now/CVE-2023-30967.md): Gotham Orbital Simulator path traversal (CVSS 9.8)
- [CVE-2023-30969](https://cve.now/CVE-2023-30969.md): Palantir Tiles missing authentication on API endpoints (CVSS 8.2)
- [CVE-2023-30961](https://cve.now/CVE-2023-30961.md): Palantir Gotham UI bug that could lead to incorrect data classification (CVSS 6.5)
- [CVE-2023-30959](https://cve.now/CVE-2023-30959.md): Stored XSS via javascript URI in Apollo Change Requests comment (CVSS 4.1)
- [CVE-2023-30962](https://cve.now/CVE-2023-30962.md): Stored XSS in cerberus attachments (CVSS 6.8)
- [CVE-2023-30952](https://cve.now/CVE-2023-30952.md): Foundry Issues reporterPath phishing by parameter injection (CVSS 5.0)
- [CVE-2023-30950](https://cve.now/CVE-2023-30950.md): CVE-2023-30950 (CVSS 6.5)
- [CVE-2023-30958](https://cve.now/CVE-2023-30958.md): DOM XSS in Developer mode dashboard via redirect GET parameter (CVSS 4.7)
- [CVE-2023-30951](https://cve.now/CVE-2023-30951.md): CVE-2023-30951 (CVSS 6.3)
- [CVE-2023-30949](https://cve.now/CVE-2023-30949.md): CVE-2023-30949 (CVSS 4.3)
- [CVE-2023-30956](https://cve.now/CVE-2023-30956.md): IDOR in Foundry Comments allows retrieval of attachments (CVSS 5.3)
- [CVE-2023-30960](https://cve.now/CVE-2023-30960.md): Insecure Direct Object Reference (IDOR) in Foundry job-tracker (CVSS 4.3)
- [CVE-2023-30963](https://cve.now/CVE-2023-30963.md): Stored XSS in Foundry Slate Query Dropdown menu (CVSS 5.4)
- [CVE-2023-22835](https://cve.now/CVE-2023-22835.md): Denial of Service in Foundry Issues (CVSS 7.7)
- [CVE-2023-30946](https://cve.now/CVE-2023-30946.md): Issues notification metadata lacks authorization (CVSS 3.5)
- [CVE-2023-30955](https://cve.now/CVE-2023-30955.md): Foundry workspace-server Developer Mode Authorization Bypass (CVSS 4.3)
- [CVE-2023-22834](https://cve.now/CVE-2023-22834.md): The contour service was not checking that users had permission to create an analysis for a given dataset (CVSS 2.7)
- [CVE-2023-30945](https://cve.now/CVE-2023-30945.md): CVE-2023-30945 (CVSS 9.8)
- [CVE-2023-22833](https://cve.now/CVE-2023-22833.md): Mandatory control bypass in Lime2 (CVSS 7.6)
- [CVE-2023-30948](https://cve.now/CVE-2023-30948.md): Retrieval of Attachments to Comments lacks Authorization (CVSS 6.5)
- [CVE-2022-48308](https://cve.now/CVE-2022-48308.md): It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory (CVSS 6.3)
- [CVE-2022-48307](https://cve.now/CVE-2022-48307.md): It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactor (CVSS 6.3)
- [CVE-2022-48306](https://cve.now/CVE-2022-48306.md): Gotham Chat IRC help does not validate hostnames in TLS certificates (CVSS 5.7)
- [CVE-2022-27897](https://cve.now/CVE-2022-27897.md): Palantir Gotham included an endpoint that would log arbitrary sized zip files. (CVSS 5.3)
- [CVE-2022-27892](https://cve.now/CVE-2022-27892.md): Palantir Gotham included an endpoint that would log arbitrary sized payloads. (CVSS 5.3)
- [CVE-2022-27891](https://cve.now/CVE-2022-27891.md): Palantir Gotham included an unauthenticated endpoint that listed all active usernames in the platform with an active session. (CVSS 5.3)
- [CVE-2022-27890](https://cve.now/CVE-2022-27890.md): It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory (CVSS 6.3)
- [CVE-2022-27895](https://cve.now/CVE-2022-27895.md): A component in Foundry logging was found to be capturing sensitive information in logs. (CVSS 4.2)
- [CVE-2022-27896](https://cve.now/CVE-2022-27896.md): The Foundry Code-Workbooks service was found to contain an issue leading to information disclosure. (CVSS 4.2)
- [CVE-2022-27894](https://cve.now/CVE-2022-27894.md): The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability. (CVSS 4.8)
- [CVE-2022-27893](https://cve.now/CVE-2022-27893.md): The Foundry Magritte plugin osisoft-pi-web-connector was found to be logging in a manner that captured authentication requests. (CVSS 4.2)
- [CVE-2022-27889](https://cve.now/CVE-2022-27889.md): The Foundry Multipass service contains code paths that could be abused to cause a denial of service for authentication and authorization operations. (CVSS 5.3)
- [CVE-2022-27888](https://cve.now/CVE-2022-27888.md): The Foundry Issues service was found to be logging in a manner that captured session tokens. (CVSS 5.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/palantir
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.