What is AmuseMints Sweets & Snacks a Division of Nassau Candy's cybersecurity risk score?

AmuseMints Sweets & Snacks a Division of Nassau Candy has an AI-generated cybersecurity risk score of 760 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has AmuseMints Sweets & Snacks a Division of Nassau Candy experienced?

According to Rankiteo, AmuseMints Sweets & Snacks a Division of Nassau Candy currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has AmuseMints Sweets & Snacks a Division of Nassau Candy been affected by any supply chain cyber incidents ?

According to Rankiteo, AmuseMints Sweets & Snacks a Division of Nassau Candy has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.

Does AmuseMints Sweets & Snacks a Division of Nassau Candy have SOC 2 Type 1 certification ?

According to Rankiteo, AmuseMints Sweets & Snacks a Division of Nassau Candy is not certified under SOC 2 Type 1.

Does AmuseMints Sweets & Snacks a Division of Nassau Candy have SOC 2 Type 2 certification ?

According to Rankiteo, AmuseMints Sweets & Snacks a Division of Nassau Candy does not hold a SOC 2 Type 2 certification.

Does AmuseMints Sweets & Snacks a Division of Nassau Candy have PCI DSS certification ?

According to Rankiteo, AmuseMints Sweets & Snacks a Division of Nassau Candy does not currently maintain PCI DSS compliance.

Does AmuseMints Sweets & Snacks a Division of Nassau Candy comply with HIPAA ?

According to Rankiteo, AmuseMints Sweets & Snacks a Division of Nassau Candy is not compliant with HIPAA regulations.

Does AmuseMints Sweets & Snacks a Division of Nassau Candy have ISO 27001 certification ?

According to Rankiteo,AmuseMints Sweets & Snacks a Division of Nassau Candy is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does AmuseMints Sweets & Snacks a Division of Nassau Candy operate in ?

AmuseMints Sweets & Snacks a Division of Nassau Candy operates primarily in the Food and Beverage Services industry.

How many employees does AmuseMints Sweets & Snacks a Division of Nassau Candy have ?

AmuseMints Sweets & Snacks a Division of Nassau Candy employs approximately 11 people worldwide.

Does AmuseMints Sweets & Snacks a Division of Nassau Candy own any subsidiaries ?

AmuseMints Sweets & Snacks a Division of Nassau Candy presently has no subsidiaries across any sectors.

How many LinkedIn followers does AmuseMints Sweets & Snacks a Division of Nassau Candy have ?

AmuseMints Sweets & Snacks a Division of Nassau Candy's official LinkedIn profile has approximately 806 followers.

What is the NAICS classification code for AmuseMints Sweets & Snacks a Division of Nassau Candy ?

AmuseMints Sweets & Snacks a Division of Nassau Candy is classified under the NAICS code 722, which corresponds to Food Services and Drinking Places.

Does AmuseMints Sweets & Snacks a Division of Nassau Candy have a Crunchbase profile ?

No, AmuseMints Sweets & Snacks a Division of Nassau Candy does not have a profile on Crunchbase.

Does AmuseMints Sweets & Snacks a Division of Nassau Candy have a LinkedIn profile ?

Yes, AmuseMints Sweets & Snacks a Division of Nassau Candy maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/amusemints-mint-company-llc.

How many peer or competitor companies does AmuseMints Sweets & Snacks a Division of Nassau Candy have ?

AmuseMints Sweets & Snacks a Division of Nassau Candy has an estimated 8,809 peer or competitor companies worldwide.

What types of cybersecurity incidents has AmuseMints Sweets & Snacks a Division of Nassau Candy faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Breach.

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

ASSDNC

Boost Score +25 with badge (5 left)

760

/1000

Fair

785

/1000

Fair

AmuseMints Sweets & Snacks a Division of Nassau Candy Vendor Cyber Rating & Cyber Score

amusemints.com

Add Your Compliance Badge

AmuseMints has been a supplier of breath mints and candy to the souvenir, gift, and specialty markets since 2004. In 2016 AmuseMints merged with Nassau Candy. The company now specializes in candy, snacks, hard goods and apparel that can be customized for any state, region, attraction, or theme. The product mix includes custom printed digi-bags, candy boxes, chocolate bars, mint tins, print on chocolate, and more. In addition to customized products many name brand and bulk candies are available to create a one stop shopping source for confections.

ASSDNC

AmuseMints Sweets & Snacks a Division of Nassau Candy CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

Nassau Candy Distri...

Breach

1/2024

NAS1771008146

Loading…

A.I.

ASSDNC Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for ASSDNC

Incidents vs Food and Beverage Services Industry Avg (This Year)

No incidents recorded for AmuseMints Sweets & Snacks a Division of Nassau Candy in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for AmuseMints Sweets & Snacks a Division of Nassau Candy in 2026.

Incident Types ASSDNC vs Food and Beverage Services Industry Avg (This Year)

No incidents recorded for AmuseMints Sweets & Snacks a Division of Nassau Candy in 2026.

Incident History - ASSDNC (X = Date, Y = Severity)

Loading…

SUBSIDIARY

AmuseMints Sweets & Snacks a Division of Nassau Candy Subsidiaries

ASSDNC

Food and Beverage Services

Website: http://www.amusemints.com

Company Size: 11

Nassau Candy Distributors, Inc.Food and Beverage Services

Loading…

AmuseMints Sweets & Snacks a Division of Nassau Candy Similar Companies

Nestlé

nestle.com

As the world’s largest food and beverage company we are driven by a simple aim: unlocking the power of food to enhance quality of life for everyone, today and for generations to come. To deliver on this, we serve with passion, with a spirit of excellence, offering products and services for all stages of life, every moment of the day, helping people care for themselves and their families. Our culture is based on our values rooted in respect: respect for ourselves, respect for others, respect for diversity and respect for the future. We can trace our origin back to 1866, when the first European condensed milk factory was opened in Cham, Switzerland, by the Anglo-Swiss Condensed Milk Company. One year later, Henri Nestlé, a trained pharmacist, launched one of the world’s first prepared infant cereals ‘Farine lactée’ in Vevey, Switzerland. Today, we employ around 273,000 people and have factories or operations in almost every country in the world. With our headquarters still based in the Swiss town of Vevey, we had sales of CHF 84.3 billion in 2020. Our portfolio covers almost every food and beverage category – offering products and services for all stages of life, every moment of the day, helping people care for themselves and their families. House rules: https://nes.tl/HouseRules

The Coca-Cola Company

coca-colacompany.com

From our roots at the counter of a local Atlanta pharmacy, to our current portfolio of more than 200 beverages, The Coca-Cola Company is one of the most globally-recognized brands in the world. Today, our lineup features beloved beverage brands, including Coca-Cola, Sprite, Fanta, smartwater, Dasani, Topo Chico, BODYARMOR, Powerade, Costa, Georgia, Goldpeak, Minute Maid, Simply, fairlife and more. The Coca-Cola Company is committed to bringing about real change – to our industry, to our local economies, and to the world around us. Through constant evolution, we continue to reimagine the way we refresh the world and make a difference. We're innovating our portfolio with products that give people more varieties that meet our consumers where they are. We're working with global partners to transform our business, and grow it in more sustainable ways. And we're providing jobs and opportunities to the local economies where our people live and work, employing 700,000 people throughout our global system alongside bottling partners. If you're a changemaker looking to make a change, come join us in our mission to refresh the world and make a difference. Learn more at: www.coca-colacompany.com/careers

US Foods

usfoods.com

US Foods is one of America’s great food companies and a leading foodservice distributor, partnering with approximately 300,000 restaurants and foodservice operators to help their businesses succeed. With 28,000 associates and more than 70 locations, US Foods provides its customers with a broad and innovative food offering and a comprehensive suite of e-commerce, technology and business solutions. US Foods is headquartered in Rosemont, IL, and generates more than $28 billion in annual revenue. Visit usfoods.com to learn more. ------------ Rules of Engagement Statement: We are proud to support community engagement on the US Foods LinkedIn page, and we're excited to see your comments, photos and videos. Please note that the views expressed by the community do not necessarily reflect those of US Foods. Before posting, please take a moment to read our rules for community content. We reserve the right to remove content that violates these rules. 1. Don't break the law. Content that appears to break the law or that advocates for breaking the law also is not permitted. 2. Be polite and courteous to everyone, even those you disagree with. This also means you may not post anything that is threatening, harassing, abusive, bullying, discriminatory, profane, sexually explicit, obscene, violent, gruesome, or similarly objectionable. 3. Stay on topic for this community and dialogue. Off-topic content may include but is not limited to irrelevant or out of context material, spam, promotional content, and links to third-party sites. 4. Follow LinkedIn's Terms and Conditions. 5. All posts must be by a real person and from a real profile. Content from fake or anonymous profiles is not permitted. 6. Our employees must also follow all of our applicable policies and guidelines, including but not limited to our Code of Conduct and Electronic Social Networking Policy.

Dairy Queen

cb dairyqueen.com

Here at the DQ® system, we believe that HAPPY TASTES GOOD®. Our first location opened in Joliet, Illinois, 80 years ago. Since then we’ve grown to more than 7,000 DQ® locations in the U.S., Canada and 22 other countries. Our restaurants offer a variety of sweet treats and crave-worthy eats that hold a special place in the hearts and minds of fans of all ages, including our signature BLIZZARD® Treat. Guided by our vision to become the world’s favorite quick-service restaurant, we’re proud of the multinational company culture we’ve built while maintaining a small community feel. Our hardworking employees believe in our mission of creating positive memories for all who touch DQ. Headquartered in Minneapolis, Minnesota, with offices in Canada and Singapore, our corporate employees support our independent franchisees from our corporate offices and field locations around the world. Giving back Since 1984, the DQ system has raised more than $154 million to support Children’s Miracle Network Hospitals® in the U.S., and the Children’s Miracle Network Member Hospitals® in Canada. Every time fans and franchisees donate to these causes, every dollar stays in the community to support the local children’s hospital. Through our corporate giving initiative, DQ Cares, we provide employees time paid time off to volunteer in their communities. Careers If you believe in creating happy smiles, lasting memories and unforgettable moments, we want to hear from you. To learn more about DAIRY QUEEN® careers, visit dairyqueen.com/us-en/Company/Careers/. Franchise opportunities To become part of our sweet success and explore franchising opportunities, visit us at dairyqueenfranchising.com. Ownership The DQ brand, along with the ORANGE JULIUS® brand, is privately owned by Berkshire Hathaway Inc., a company owned by the legendary investor, Warren Buffet. Read our Social Media Community Guidelines: http://bit.ly/DQSocialCommunityGuidelines

Coca-Cola Consolidated

CokeConsolidated.com

Coca-Cola Consolidated is the largest Coca-Cola bottler in the United States. Our Purpose is to honor God in all we do, serve others, pursue excellence, and grow profitably. For over 120 years, we have been deeply committed to the consumers, customers, and communities we serve and are passionate about the broad portfolio of beverages and services we offer. We make, sell, and distribute beverages of The Coca-Cola Company and other partner companies in more than 300 brands and flavors across 14 states and the District of Columbia to approximately 60 million consumers. Headquartered in Charlotte, N.C., Coca-Cola Consolidated is traded on the NASDAQ Global Select Market under the symbol “COKE.” More information about the Company is available at www.cokeconsolidated.com. Follow Coca-Cola Consolidated on Facebook, Twitter, Instagram and LinkedIn.

Grupo Bimbo

grupobimbo.com

Grupo Bimbo es la empresa líder en panificación y un jugador relevante en snacks. Hornea +9,000 productos, distribuyéndolos a través de +3.5 millones de puntos de venta con +54,000 rutas. Grupo Bimbo tiene +153,000 colaboradores, +1,500 centros de ventas estratégicamente localizados en 35 países de América, Europa, Asia y África. 249 panaderías y plantas, distribuye, comercializa y elabora una variedad de productos, entre los que destacan el pan de caja, bollería, pan dulce, pastelitos, galletas, pan tostado, English muffins, bagels, tortillas y flatbread y botanas saladas, entre otros. Grupo Bimbo tiene +100 marcas, algunas de ellas son Bimbo, Marinela, Barcel, Milpa Real, Tía Rosa, Thomas, Takis, Sara Lee, Little Bites, Artesano, Saníssimo, Pullman, Ideal, Harvest Gold, The Rustik Bakery, Dempsters, POM, Supán, entre otros. Sus acciones cotizan en la Bolsa Mexicana de Valores (BMV) bajo la clave de pizarra BIMBO y en el mercado extrabursátil de Estados Unidos a través de un programa de ADR Nivel 1, bajo la clave de pizarra BMBOY.

Suntory Holdings Limited

suntory.com

As a global leader in the beverage industry, Suntory Group aims to inspire the brilliance of life, by creating rich experiences for people, in harmony with nature. Sustained by the gifts of nature and water, the Group offers a uniquely diverse portfolio of products, from award-winning Japanese whiskies Yamazaki and Hibiki, iconic American whiskies Jim Beam and Maker's Mark, canned ready-to-drink -196 (minus one-nine-six), The Premium Malt’s beer, Japanese wine Tomi, and the world-famous Château Lagrange. Its brand collection also includes non-alcoholic favorites Orangina, Lucozade, Oasis, BOSS coffee, Suntory Tennensui water, TEA+ Oolong Tea, and V energy drink, as well as popular health and wellness product Sesamin EX. Founded as a family-owned business in 1899 in Osaka, Japan, Suntory Group has grown into a global company operating throughout the Americas, Europe, Africa, Asia and Oceania, with an annual revenue (excluding excise taxes) of $20.5 billion in 2025. Its 41,628 employees worldwide draw upon the unique blend of Japanese artisanship and global tastes to explore new product categories and markets.

Molson Coors Beverage Company

molsoncoors.com

From Coors Light, Miller Lite, Molson Canadian, Carling and Staropramen to Coors Banquet, Blue Moon Belgian White, Leinenkugel’s Summer Shandy, Vizzy, Creemore Springs and more, our 16,000+ employees across the globe make and market many of the most beloved beverage brands in the world. While our history is rooted in beer, we offer a modern portfolio that expands beyond the beer aisle with energy drinks, non-alc beer and canned cocktails, ready-to-drink coffee and more. Molson Coors Beverage Company is a publicly traded company that operates through Molson Coors North America and Molson Coors Europe, and is traded on the New York and Canadian Stock Exchange (TAP). Our commitment to raising industry standards, promoting the responsible consumption of our products, and leaving a positive imprint on our employees, consumers and communities is reflected on our website, www.molsoncoors.com. Celebrate responsibly. Follow only if legal drinking age and do not share with those who are underage. TERMS: http://bit.ly/TnCs-MC

Compass Group

cb compass-group.com

Compass Group is a global leader in food services operating in over 25 countries with around 590,000 employees worldwide and generating underlying revenues of over $46 billion for the 2025 fiscal year. Our vision is to be a world-class provider of contract food services and support services, renowned for our great people, our great service, and our great results.

Loading…

NEWS

AmuseMints Sweets & Snacks a Division of Nassau Candy CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

September 13, 2024 07:00 AM

What’s hot in confectionery? New product development from Perfetti Van Melle to Terry’s

From Kamala Harris-themed mints to flavour-changing gum, meet the latest confectionery launches disrupting the industry.

Read Article

August 27, 2024 07:00 AM

Nassau Candy Dares to ‘Talk Politics’ at the Dinner Table with Kamala Harris Line

The wholesale manufacturer of gourmet food products is introducing new Kamala Harris-themed treats to its 2024 election collection.

Read Article

August 27, 2024 07:00 AM

US presidential race for the White House captured with new Nassau Candy series

As the pivotal race for the US White House heats up between former Republican president Donald Trump and Democrat Vice President Kamala...

Read Article

April 26, 2024 07:00 AM

Nassau Candy introduces election-themed mints, chocolates

AmuseMints' Election Collection features an assortment of chocolate bars and mint tins featuring this year's major candidates: Donald Trump and Joe Biden.

Read Article

March 18, 2024 07:00 AM

Nassau Candy addresses sustainable confectionery packaging

Nassau's AmuseMints brand will introduce compostable peg bags with a phased rollout for in-house brands.

Read Article

June 21, 2021 07:00 AM

Nassau Candy to debut chocolate, gummy creations at Sweets & Snacks Expo | 2021-06-21

Nassau Candy will reveal its latest chocolate and exclusive gummy creations at Sweets & Snacks 2021.

Read Article

June 10, 2020 07:00 AM

Nassau Candy acquires assets of Pennsylvania Dutch Candies

Nassau Candy has acquired the assets of Pennsylvania Dutch Candies, a national manufacturer and distributor of top selling nostalgic...

Read Article

September 16, 2016 07:00 AM

Nassau Candy acquires assets of novelty, specialty distributor Hobbs & Dobbs

Confectionery distributor Nassau Candy has acquired certain assets of Hobbs & Dobbs, Inc., a leading novelty and specialty candy distributor...

Read Article

July 13, 2016 07:00 AM

Nassau Candy acquires AmuseMints LLC

The new division will join Nassau Candy's thousands of confectionery, gourmet and natural foods SKUs and will merge its best-in-class...

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-86564

SUMMARY

A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: 3.3)

cvss3

Base Score: 3.3

Complexity: LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Impact Score

1.4

Exploitability

1.8

REFERENCES

CVE-2026-55250

SUMMARY

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low cache memory that causes premature eviction to free up memory and applications running macropay-solutions/maravel-framework that utilize tymon/jwt-auth for API token authentication and blacklist management or any other package that does the same may be affected. This architectural risk might also impact native Laravel applications utilizing cache tags under specific volatile or eviction-capped environments. tymon/jwt-auth automatically probes for cache tag support. If found, it forcefully wraps 14-day token blacklist entries (jti) inside a relational tymon.jwt tag. In environments where the O(1) Atomic Lazy Eviction model is active — either natively inside Maravel-Framework v20.x or manually backported into v10.x via the explicit DI container singletons provided in PR #104 (App\Cache\TaggedCache and App\Cache\TagSet) — a strict global tracking ceiling (Container::TAGGED_CACHE_TTL_CAP_SECONDS) of 7,200 seconds (2 hours) is enforced to secure the system against memory index bloat. This ceiling forcefully truncates the 14-day blacklist lifespan down to a maximum of 2 hours, after which individual tracking keys naturally expire and disappear from the active cache window. Furthermore, because the optimized engine implements a generational version matrix to achieve O(1) flush speeds, any programmatic or manual invocation of a tag flush or reset (e.g., Cache::tags([...])->flush()) instantly bumps the internal atomic master version pointer. This shifts the computed cryptographic composite hash (sha1($this->tags->getNamespace())) for all overlapping components, rendering the entire existing index immediately unreachable. Consequently, through either natural 2-hour expiration or an intervening tag flush execution (like the cache naturally cleaning old values to free up memory), the invalidation state records are entirely wiped out. Because the tokens' physical cryptographic signatures remain structurally valid for up to 14 days, stolen, hijacked, or legitimately logged-out tokens are instantly and silently resurrected across the entire API gateway, leaving the application critically vulnerable to widespread Token Replay Attacks. Because this issue is caused by an upstream architectural assumption within the tymon/jwt-auth package rather than a core defect inside the framework, there is no direct framework version upgrade that can safely bypass this lifecycle collision without breaking business cache recycling bounds. Maravel version 10.74.0 introduced a way to backport the new fixed tagged cache from 20.x into 10.x by resolving TagSet and TaggedCache from DI, which is how this latent architectural lifecycle vulnerability was discovered. Users must apply the decoupled configuration workaround outlined below. As a workaround, make sure that cache memory size does not generate early natural evictions from cache to free up space, deleting blacklisted jwt ids before they expire. Applications must decouple flat authentication vectors from the relational tagging subsystem. This forces token identifiers to write directly to the primary cache keyspace as flat, un-tagged key-value pairs where they securely retain their unclipped 14-day lifecycle.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: )

cvss4

Base Score: 8.7

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-53639

SUMMARY

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the `GET /api/v2/shop/payment-requests/{hash}` and `PUT /api/v2/shop/payment-requests/{hash}` endpoints look up the payment request solely by the hash from the URL. No ownership check is performed against the authenticated customer or the underlying order. An attacker who obtains a payment request hash can read the payment request and, through the `payment` IRI in the response, recover the underlying order's `tokenValue` (which itself grants access to the full order, items, addresses, customer email, totals); and/or update the payment request payload (e.g. `target_path`, `after_path`). These fields are used by the front-end controller to redirect the user after the payment, so an attacker can flip them to an attacker-controlled URL and intercept the buyer. The hash is a UUID, so it has to be obtained out-of-band (logs, shared links, referrer headers, a co-located client), but once it is known no other credential is required, neither authentication nor knowledge of the order token. The creation endpoint `POST /api/v2/shop/orders/{tokenValue}/payment-requests` shares the same flaw: it resolves the target order solely from the `tokenValue` in the URL without verifying that the caller owns the order. The issue is fixed in versions 2.0.18, 2.1.15, and 2.2.6. As a workaround, add a query extension that filters the `GET` operation; decorate the `PUT` state provider, guard the `POST` creation endpoint with a command-bus middleware, and wire the services.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: )

cvss4

Base Score: 6.3

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://github.com/Sylius/Sylius/security/advisories/GHSA-mr9r-h354-966r

CVE-2026-53638

SUMMARY

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass vulnerability exists in the shop account API. The `PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}` endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid (state `STATE_NEW`), does not validate that the chosen payment method is enabled for the order's channel. The equivalent checkout endpoint (`PATCH /api/v2/shop/orders/{tokenValue}/payments/{paymentId}`) correctly rejects out-of-channel payment methods with `HTTP 422`; the account endpoint silently accepts them and returns `HTTP 200`. An authenticated customer can therefore assign any globally enabled payment method to their own placed order, including methods that the store operator has explicitly excluded from that channel. The issue is fixed in versions: 2.0.18, 2.1.15, 2.2.6 and above. As a workaround, decorate the `Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface` service in the application.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: 4.3)

cvss3

Base Score: 4.3

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Impact Score

1.4

Exploitability

2.8

REFERENCES

https://github.com/Sylius/Sylius/security/advisories/GHSA-6955-hrm5-c4qp

CVE-2026-53637

SUMMARY

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart `FormComponent`. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched `FormComponent` into the application's `src/` directory and override the `sylius_shop.twig.component.cart.form` service definition to use that class.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: 6.5)

cvss3

Base Score: 6.5

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Impact Score

3.6

Exploitability

2.8

REFERENCES

https://github.com/Sylius/Sylius/security/advisories/GHSA-5597-7rmh-97q5

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…

Badge your company to reduce your risk score and your cyber insurance costs!

Trusted by insurers. Chosen by leaders.

AmuseMints Sweets & Snacks a Division of Nassau Candy Vendor Cyber Rating & Cyber Score

ASSDNC A.I CyberSecurity Scoring

AmuseMints Sweets & Snacks a Division of Nassau Candy CyberSecurity News & History

ASSDNC Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Incident Predictions locked

A.I Risk Score Likelihood 3 - 6 - 9 months

A.I. Risk Score Predictions locked

Underwriter Stats for ASSDNC

Incidents vs Food and Beverage Services Industry Avg (This Year)

Incidents vs All-Companies Average (This Year)

Incident Types ASSDNC vs Food and Beverage Services Industry Avg (This Year)

Incident History - ASSDNC (X = Date, Y = Severity)

AmuseMints Sweets & Snacks a Division of Nassau Candy Subsidiaries

ASSDNC

AmuseMints Sweets & Snacks a Division of Nassau Candy Similar Companies

Nestlé

The Coca-Cola Company

US Foods

Dairy Queen

Coca-Cola Consolidated

Grupo Bimbo

Suntory Holdings Limited

Molson Coors Beverage Company

Compass Group

AmuseMints Sweets & Snacks a Division of Nassau Candy CyberSecurity News

What’s hot in confectionery? New product development from Perfetti Van Melle to Terry’s

Nassau Candy Dares to ‘Talk Politics’ at the Dinner Table with Kamala Harris Line

US presidential race for the White House captured with new Nassau Candy series

Nassau Candy introduces election-themed mints, chocolates

Nassau Candy addresses sustainable confectionery packaging

Nassau Candy to debut chocolate, gummy creations at Sweets & Snacks Expo | 2021-06-21

Nassau Candy acquires assets of Pennsylvania Dutch Candies

Nassau Candy acquires assets of novelty, specialty distributor Hobbs & Dobbs

Nassau Candy acquires AmuseMints LLC

Global CVEs (Not Company-Specific)

Access Data Using Our API

What Do We Measure ?

These are some of the factors we use to calculate the overall score:

Rankiteo

AmuseMints Sweets & Snacks a Division of Nassau Candy CyberSecurity News & History

ASSDNC Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Incident Predictions locked

A.I Risk Score Likelihood 3 - 6 - 9 months

A.I. Risk Score Predictions locked

Underwriter Stats for ASSDNC

Incidents vs Food and Beverage Services Industry Avg (This Year)

Incidents vs All-Companies Average (This Year)

Incident Types ASSDNC vs Food and Beverage Services Industry Avg (This Year)

Incident History - ASSDNC (X = Date, Y = Severity)

AmuseMints Sweets & Snacks a Division of Nassau Candy Subsidiaries

ASSDNC

AmuseMints Sweets & Snacks a Division of Nassau Candy Similar Companies

Nestlé

The Coca-Cola Company

US Foods

Dairy Queen

Coca-Cola Consolidated

Grupo Bimbo

Suntory Holdings Limited

Molson Coors Beverage Company

Compass Group

AmuseMints Sweets & Snacks a Division of Nassau Candy CyberSecurity News

What’s hot in confectionery? New product development from Perfetti Van Melle to Terry’s

Nassau Candy Dares to ‘Talk Politics’ at the Dinner Table with Kamala Harris Line

US presidential race for the White House captured with new Nassau Candy series

Nassau Candy introduces election-themed mints, chocolates

Nassau Candy addresses sustainable confectionery packaging

Nassau Candy to debut chocolate, gummy creations at Sweets & Snacks Expo | 2021-06-21

Nassau Candy acquires assets of Pennsylvania Dutch Candies

Nassau Candy acquires assets of novelty, specialty distributor Hobbs & Dobbs

Nassau Candy acquires AmuseMints LLC

Global CVEs (Not Company-Specific)

Access Data Using Our API

What Do We Measure ?

These are some of the factors we use to calculate the overall score:

Rankiteo