cve-coordination@palantir.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS cve-coordination@palantir.com
03
assessed vulnerabilities (47)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-68609US | — | — | ||
A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default configuration. The defect r… | ||||
| CVE-2025-62487US | —OT elevated | — | ||
On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels. The regression was t… | ||||
| CVE-2024-49587US | — | — | ||
Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directl… | ||||
| CVE-2023-30971US | — | — | ||
Gotham Gaia application was found to be exposing multiple unauthenticated endpoints. | ||||
| CVE-2025-53710US | — | — | ||
Due to a product misconfiguration in certain deployment types, it was possible from different pods in the same namespace to communicate with each other. This issue resulted in bypa… | ||||
| CVE-2025-64400US | — | — | ||
Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating users checks that the account requesting… | ||||
| CVE-2025-53709US | — | — | ||
Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small number of environments.
U… | ||||
| CVE-2024-49589US | — | — | ||
Foundry Artifacts was found to be vulnerable to a Denial Of Service attack due to disk being potentially filled up based on an user supplied argument (size). | ||||
| CVE-2024-49581US | —OT elevated | — | ||
Restricted Views backed objects (OSV1) could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have permission to see such o… | ||||
| CVE-2024-49588US | — | — | ||
Multiple endpoints in `oracle-sidecar` in versions 0.347.0 to 0.543.0 were found to be vulnerable to SQL injections. | ||||
| CVE-2023-30968US | — | — | ||
One of Gotham Gaia services was found to be vulnerable to a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker to bypass CSP and get a persistent c… | ||||
| CVE-2023-30970US | medium6.5 | — | ||
Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file system.
| ||||
| CVE-2023-22836US | medium5.4OT elevated | — | ||
In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes a group name from the default value, the renamed value may be visible to the re… | ||||
| CVE-2023-30954US | low3.7 | — | ||
The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not yet initialized. | ||||
| CVE-2023-30969US | medium6.5OT elevated | — | ||
The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints.
| ||||
| CVE-2023-30967US | high7.5 | — | ||
Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files on the file system. | ||||
| CVE-2023-30961US | medium6.1 | — | ||
Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly created property or li… | ||||
| CVE-2023-30959US | medium5.4 | — | ||
In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction. | ||||
| CVE-2023-30962US | medium5.4 | — | ||
The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Gotham to launch attacks against… | ||||
| CVE-2023-30958US | medium6.1 | — | ||
A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed.
This defect was resolved with… | ||||