Vulnerabilities in Palantir
47 resultsCVE-2023-30960MEDIUMInsecure Direct Object Reference (IDOR) in Foundry job-trackerEPSS 0.4%CVE-2022-27896MEDIUMThe Foundry Code-Workbooks service was found to contain an issue leading to information disclosure.EPSS 0.4%CVE-2022-27895MEDIUMA component in Foundry logging was found to be capturing sensitive information in logs.EPSS 0.4%CVE-2023-30958MEDIUMDOM XSS in Developer mode dashboard via redirect GET parameterEPSS 0.4%CVE-2023-30946LOWIssues notification metadata lacks authorizationEPSS 0.4%CVE-2023-30963MEDIUMStored XSS in Foundry Slate Query Dropdown menuEPSS 0.4%CVE-2024-49581MEDIUMAccess control issue impacting RV backed objectsEPSS 0.4%CVE-2023-30962MEDIUMStored XSS in cerberus attachmentsEPSS 0.4%CVE-2023-30955MEDIUMFoundry workspace-server Developer Mode Authorization BypassEPSS 0.4%CVE-2023-30959MEDIUMStored XSS via javascript URI in Apollo Change Requests commentEPSS 0.4%CVE-2023-22834LOWThe contour service was not checking that users had permission to create an analysis for a given datasetEPSS 0.4%CVE-2024-49587CRITICALGlutton V1 endpoints missing authenticationEPSS 0.3%CVE-2023-30954LOWGotham Video Broken AuthenticationEPSS 0.3%CVE-2024-49588MEDIUMMultiple authenticated SQL injections in oracle-sidecarEPSS 0.3%CVE-2025-53710HIGHNetwork boundaries not respected in certain Foundry namespaces.EPSS 0.3%CVE-2023-22836LOWIn cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes the linter name from the default value, the renamed value may be visible to the rest of the stack’s tenants.EPSS 0.3%CVE-2022-48306MEDIUMGotham Chat IRC help does not validate hostnames in TLS certificatesEPSS 0.3%CVE-2022-27888MEDIUMThe Foundry Issues service was found to be logging in a manner that captured session tokens.EPSS 0.2%CVE-2023-30971MEDIUMGaia unauthenticated endpointsEPSS 0.2%CVE-2025-62487LOWUnder certain configurations, file artifacts uploaded to the Dossier and Slides apps did not inherit security markings of their parent artifact. This lack of security markings could lead to unintended access to the uploaded files.EPSS 0.2%