Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Jan 14, 2026Gotham Block Extra Light: Stored Cross-Site ScriptingCVE-2025-15021 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Gotham Block Extra Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Gotham Block Extra Light
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Gotham Block Extra Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 14, 2026Gotham Block Extra Light: Arbitrary File ReadCVE-2025-15020 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Gotham Block Extra Light plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.5.0 via the 'ghostban' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Gotham Block Extra Light
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Gotham Block Extra Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 9, 2026On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels.CVE-2025-62487 · Other software · Palantir · reported by cve-coordination@palantir.comLow 3.5
On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels. The regression was traced back to a change in May 2025, which was meant to allow file uploads to be shared among different artifacts (e.g. other dossiers and presentations). On deployments configured with CBAC, the front-end would present a security picker dialog to set the security level on the uploads, thereby mitigating the issue. On deployments without a CBAC configuration, no security picker dialog appears, leading to a security level of CUSTOM with no markings or datasets selected. The resulting markings and groups for the file uploads thus will be only those added by the default authorization rules defined in the Auth Chooser configuration. On most environments, it is expected that the default authorization rules only add the Everyone group.
- Product
- com.palantir.acme:gotham-default-apps-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit gluCVE-2024-49587 · Other software · Palantir · reported by cve-coordination@palantir.comCritical 9.1
Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automatically deployed to all Apollo-managed Gotham Instances
- Product
- com.palantir.gotham:glutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025Gotham Gaia application was found to be exposing multiple unauthenticated endpoints.CVE-2023-30971 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 6.8
Gotham Gaia application was found to be exposing multiple unauthenticated endpoints.
- Product
- com.palantir.acme.gaia:gaia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024Restricted Views backed objects (OSV1) could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have permCVE-2024-49581 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 6.5
Restricted Views backed objects (OSV1) could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have permission to see such objects to view them via Object Explorer directly. This software bug did not impact or otherwise make data available across organizational boundaries nor did it allow for data to be viewed or accessed by unauthenticated users. The affected service have been patched and automatically deployed to all Apollo-managed Foundry instances.
- Product
- com.palantir.gotham:external-artifacts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2024One of Gotham Gaia services was found to be vulnerable to a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker to bypass CSP anCVE-2023-30968 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 6.8
One of Gotham Gaia services was found to be vulnerable to a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker to bypass CSP and get a persistent cross site scripting payload on the stack.
- Product
- com.palantir.acme.gaia:gaia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Jan 29, 2024Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file syCVE-2023-30970 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 6.5
Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file system.
- Product
- com.palantir.gotham:blackbird-witchcraft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Nov 15, 2023The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not yeCVE-2023-30954 · Other software · Palantir · reported by cve-coordination@palantir.comLow 2.7
The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not yet initialized.
- Product
- com.palantir.video:video-application-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Oct 25, 2023Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files CVE-2023-30967 · Other software · Palantir · reported by cve-coordination@palantir.comCritical 9.8
Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files on the file system.
- Product
- com.palantir.meta:orbital-simulator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Sep 27, 2023Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly crCVE-2023-30961 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 6.5
Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly created property or link.
- Product
- com.palantir.acme:gotham-fe-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Sep 12, 2023The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Gotham to lauCVE-2023-30962 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 6.8
The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Gotham to launch attacks against other users. This vulnerability is resolved in Cerberus 100.230704.0-27-g031dd58 .
- Product
- com.palantir.acme.cerberus:cerberus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Jun 26, 2023Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary CVE-2023-30945 · Other software · Palantir · reported by cve-coordination@palantir.comCritical 9.8
Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A malicious attacker could read sensitive files from the filesystem or write/delete arbitrary files on the filesystem as well.
- Product
- com.palantir.gotham:clips2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Feb 16, 2023Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker in a privileged netCVE-2022-48306 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 5.7
Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. This issue affects: Palantir Palantir Gotham Chat IRC helper versions prior to 30221005.210011.9242.
- Product
- Palantir Gotham Chat IRC helper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory.CVE-2022-27897 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 5.3
Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attacker could repeatedly upload a malicious zip file, which would allow them to exhaust memory resources on the dispatch server.
- Product
- Gotham
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispatcCVE-2022-27892 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 5.3
Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispatch service.
- Product
- Gotham
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session.CVE-2022-27891 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 5.3
Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected services have been patched and automatically deployed to all Apollo-managed Gotham instances. It is highly recommended that customers upgrade all affected services to the latest version. This issue affects: Palantir Gotham versions prior to 103.30221005.0.
- Product
- Gotham
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.