PatchTheCVE: palantirhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2023-30970: Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenthttps://patchthecve.com/cve/CVE-2023-30970.htmlhttps://patchthecve.com/cve/CVE-2023-30970.htmlWed, 17 Jun 2026 05:56:00 +0000MEDIUM 6.5: Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file system. CVE-2023-30954: The Gotham video-application-server service contained a race condition which would cause it to not apply certahttps://patchthecve.com/cve/CVE-2023-30954.htmlhttps://patchthecve.com/cve/CVE-2023-30954.htmlWed, 17 Jun 2026 05:55:58 +0000LOW 2.7: The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not yet initialized.CVE-2023-30969: The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performhttps://patchthecve.com/cve/CVE-2023-30969.htmlhttps://patchthecve.com/cve/CVE-2023-30969.htmlWed, 17 Jun 2026 05:56:00 +0000HIGH 8.2: The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints. CVE-2023-30967: Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowinhttps://patchthecve.com/cve/CVE-2023-30967.htmlhttps://patchthecve.com/cve/CVE-2023-30967.htmlWed, 17 Jun 2026 05:56:00 +0000CRITICAL 9.8: Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files on the file system. CVE-2023-30961: Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could havehttps://patchthecve.com/cve/CVE-2023-30961.htmlhttps://patchthecve.com/cve/CVE-2023-30961.htmlWed, 17 Jun 2026 05:55:59 +0000MEDIUM 6.5: Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly created property or link.CVE-2023-30959: In Apollo change requests, comments added by users could contain a javascript URI link that when rendered wilhttps://patchthecve.com/cve/CVE-2023-30959.htmlhttps://patchthecve.com/cve/CVE-2023-30959.htmlWed, 17 Jun 2026 05:55:59 +0000MEDIUM 4.1: In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction.CVE-2023-30962: The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could havhttps://patchthecve.com/cve/CVE-2023-30962.htmlhttps://patchthecve.com/cve/CVE-2023-30962.htmlWed, 17 Jun 2026 05:56:00 +0000MEDIUM 6.8: The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Gotham to launch attacks against other users. This vulnerability is resolved in Cerberus 100.230704.0-27-g031dd58 .