What is CETESB - Companhia Ambiental do Estado de São Paulo's cybersecurity risk score?

CETESB - Companhia Ambiental do Estado de São Paulo has an AI-generated cybersecurity risk score of 767 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has CETESB - Companhia Ambiental do Estado de São Paulo experienced?

According to Rankiteo, CETESB - Companhia Ambiental do Estado de São Paulo currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has CETESB - Companhia Ambiental do Estado de São Paulo been affected by any supply chain cyber incidents ?

According to Rankiteo, CETESB - Companhia Ambiental do Estado de São Paulo has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.

Does CETESB - Companhia Ambiental do Estado de São Paulo have SOC 2 Type 1 certification ?

According to Rankiteo, CETESB - Companhia Ambiental do Estado de São Paulo is not certified under SOC 2 Type 1.

Does CETESB - Companhia Ambiental do Estado de São Paulo have SOC 2 Type 2 certification ?

According to Rankiteo, CETESB - Companhia Ambiental do Estado de São Paulo does not hold a SOC 2 Type 2 certification.

Does CETESB - Companhia Ambiental do Estado de São Paulo comply with GDPR ?

According to Rankiteo, CETESB - Companhia Ambiental do Estado de São Paulo is not listed as GDPR compliant.

Does CETESB - Companhia Ambiental do Estado de São Paulo have PCI DSS certification ?

According to Rankiteo, CETESB - Companhia Ambiental do Estado de São Paulo does not currently maintain PCI DSS compliance.

Does CETESB - Companhia Ambiental do Estado de São Paulo comply with HIPAA ?

According to Rankiteo, CETESB - Companhia Ambiental do Estado de São Paulo is not compliant with HIPAA regulations.

Does CETESB - Companhia Ambiental do Estado de São Paulo have ISO 27001 certification ?

According to Rankiteo,CETESB - Companhia Ambiental do Estado de São Paulo is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does CETESB - Companhia Ambiental do Estado de São Paulo operate in ?

CETESB - Companhia Ambiental do Estado de São Paulo operates primarily in the Government Administration industry.

How many employees does CETESB - Companhia Ambiental do Estado de São Paulo have ?

CETESB - Companhia Ambiental do Estado de São Paulo employs approximately 1,253 people worldwide.

Does CETESB - Companhia Ambiental do Estado de São Paulo own any subsidiaries ?

CETESB - Companhia Ambiental do Estado de São Paulo presently has no subsidiaries across any sectors.

How many LinkedIn followers does CETESB - Companhia Ambiental do Estado de São Paulo have ?

CETESB - Companhia Ambiental do Estado de São Paulo's official LinkedIn profile has approximately 61,794 followers.

What is the NAICS classification code for CETESB - Companhia Ambiental do Estado de São Paulo ?

CETESB - Companhia Ambiental do Estado de São Paulo is classified under the NAICS code 92, which corresponds to Public Administration.

Does CETESB - Companhia Ambiental do Estado de São Paulo have a Crunchbase profile ?

No, CETESB - Companhia Ambiental do Estado de São Paulo does not have a profile on Crunchbase.

Does CETESB - Companhia Ambiental do Estado de São Paulo have a LinkedIn profile ?

Yes, CETESB - Companhia Ambiental do Estado de São Paulo maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/cetesbsp.

How many cybersecurity incidents has CETESB - Companhia Ambiental do Estado de São Paulo experienced ?

As of August 2, 2026, Rankiteo reports that CETESB - Companhia Ambiental do Estado de São Paulo has not experienced any cybersecurity incidents.

How many peer or competitor companies does CETESB - Companhia Ambiental do Estado de São Paulo have ?

CETESB - Companhia Ambiental do Estado de São Paulo has an estimated 13,106 peer or competitor companies worldwide.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

CCAEDSP

Boost Score +25 with badge (5 left)

767

/1000

Fair

792

/1000

Fair

CETESB - Companhia Ambiental do Estado de São Paulo Vendor Cyber Rating & Cyber Score

cetesb.sp.gov.br

Add Your Compliance Badge

A Companhia Ambiental do Estado de São Paulo – CETESB é a agência do Governo do Estado responsável pelo controle, fiscalização, monitoramento e licenciamento de atividades geradoras de poluição, com a preocupação fundamental de preservar e recuperar a qualidade das águas, do ar e do solo. A CETESB tornou-se um dos 16 centros de referência da Organização das Nações Unidas – ONU para questões ambientais, atuando em estreita colaboração com os 184 países que integram esse organismo internacional. É uma das cinco instituições mundiais da Organização Mundial de Saúde – OMS para questões de abastecimento de água e saneamento, além de órgão de referência e consultoria do Programa das Nações Unidas para o Desenvolvimento – PNUD, para questões

CCAEDSP A.I CyberSecurity Scoring

Scoring History

CCAEDSP

CETESB - Companhia Ambiental do Estado de São Paulo CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

No data available

Loading…

A.I.

CCAEDSP Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for CCAEDSP

Incidents vs Government Administration Industry Avg (This Year)

No incidents recorded for CETESB - Companhia Ambiental do Estado de São Paulo in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for CETESB - Companhia Ambiental do Estado de São Paulo in 2026.

Incident Types CCAEDSP vs Government Administration Industry Avg (This Year)

No incidents recorded for CETESB - Companhia Ambiental do Estado de São Paulo in 2026.

Incident History - CCAEDSP (X = Date, Y = Severity)

Loading…

SUBSIDIARY

CETESB - Companhia Ambiental do Estado de São Paulo Subsidiaries

CCAEDSP

Government Administration

Website: https://www.cetesb.sp.gov.br/

Company Size: 1,253

Governo do Estado de São PauloGovernment Administration

Universidade de São PauloEducação superior

Centro de Tecnologia da Informação de São CarlosInformation Technology & Services

Agência USP de InovaçãoResearch Services

Centro Paula SouzaGovernment Administration

SabespEnvironmental Services

FAPESPResearch Services

Porto de São SebastiãoTransportation, Logistics, Supply Chain and Storage

Faculdade de Medicina de Marília - FamemaHigher Education

ARTESP - Agência Reguladora de Serviços Públicos Delegados de Transporte do Estado de São PauloTransportation Programs

Universidade Estadual de CampinasPesquisa e desenvolvimento cientifico

IAMSPE - Instituto de Assistência Médica ao Servidor Público EstadualHuman Resources

Subsecretaria de Parcerias do Estado de São PauloAdministração pública, defesa e seguridade social

Metrô de São PauloRail Transportation

EMAE - Empresa Metropolitana de Águas e Energia S.A.Utilities

CEDAB-Centro de Estudos Desportivos e Artísticos do BrasilEntertainment Providers

Desenvolve SPFinancial Services

Fundação Pró-Sangue Hemocentro de São PauloHealth, Wellness & Fitness

DERSACivil Engineering

IPENGovernment Administration

Fundação SeadePublic Policy Offices

Secretaria de Desenvolvimento Econômico do Estado de São PauloGovernment Administration

FUNDAP GuatemalaCivic and Social Organizations

Hospital das Clínicas da Fac. de Medicina de Rib. Preto da Univ. de São Paulo - USPHospitals and Health Care

DER - Departamento de Estradas de Rodagem do Estado de São PauloGovernment Administration

Instituto de Pesos e Medidas - IpemGovernment Administration

Secretaria de Estado da Saúde de São PauloUtilities

Faculdade de Medicina de São José do Rio Preto - FAMERPResearch Services

EMPRESA METROPOLITANA DE TRANSPORTES URBANOS DE SÃO PAULO – EMTU/SPTruck Transportation

Companhia Paulista de Obras e ServiçosCivil Engineering

Loading…

CETESB - Companhia Ambiental do Estado de São Paulo Similar Companies

FDA

fda.gov

The Food and Drug Administration is an agency within the Department of Health and Human Services. The FDA is responsible for protecting the public health by ensuring the safety, efficacy, and security of human and veterinary drugs, biological products, and medical devices; and by ensuring the safety of our nation's food supply, cosmetics, and products that emit radiation. FDA also has responsibility for regulating the manufacturing, marketing, and distribution of tobacco products to protect the public health and to reduce tobacco use by minors. FDA is responsible for advancing the public health by helping to speed innovations that make medical products more effective, safer, and more affordable and by helping the public get the accurate, science-based information they need to use medical products and foods to maintain and improve their health. FDA also plays a significant role in the Nation's counterterrorism capability. FDA fulfills this responsibility by ensuring the security of the food supply and by fostering development of medical products to respond to deliberate and naturally emerging public health threats.

Government of Alberta

alberta.ca

Work with the Alberta government to build a stronger province for current and future generations. We offer diverse and rewarding employment opportunities in an environment that encourages continuous learning and career growth. We are one of the largest employers in Alberta with over 27,000 employees throughout the province. We are an award winning organization that values respect, accountability, integrity, and excellence. Our employees share a common vision of proudly working together to build a stronger province and make a positive and lasting difference in the lives of Albertans. The people of Alberta enjoy a very high quality of life, including the lowest overall taxes in Canada. www.jobs.alberta.ca Please see our comment policy: https://www.alberta.ca/social-media-comment-policy.aspx

Belastingdienst

belastingdienst.nl

De organisatie bestaat uit diverse onderdelen, waaronder de Belastingdienst, Douane, Toeslagen, FIOD en enkele facilitaire organisaties. Met ruim 30.000 medewerkers werken we in kantoren die verspreid zijn over het hele land. Gezamenlijk heffen, innen en controleren we belastingen. Daarnaast zorgen we ook voor het uitbetalen van toeslagen. En zijn we verantwoordelijk voor douanetaken en het opsporen van fraude. De Belastingdienst is een organisatie die 24 uur per dag, 7 dagen per week in dienst staat van de samenleving. Waar jaarlijks miljoenen aangiften worden behandeld, en waar voor honderden miljoenen aan toeslagen worden uitbetaald. En waar de Douane dagelijks zorgt voor de vlotte en veilige in- en uitvoer van tonnen goederen. Ondanks deze grote aantallen streven wij waar mogelijk naar individuele en persoonlijke dienstverlening. En in de vorm van bijvoorbeeld convenanten en partnerships werken wij ook zo goed mogelijk samen met het bedrijfsleven en andere ketenpartners. De Belastingdienst: grootschalig, veelzijdig en altijd maatschappelijk relevant.

Centers for Disease Control and Prevention

cdc.gov

CDC works 24/7 keeping America safe from health, safety and security threats, both foreign and domestic. Whether diseases start at home or abroad, are chronic or acute, curable or preventable, human error or deliberate attack, CDC fights it and supports communities and citizens to prevent it. CDC is the nation’s health protection agency - saving lives, protecting people from health threats, and saving money through prevention. For more information, please go to: http://www.cdc.gov/ Comment Policy: Please visit http://www.cdc.gov/SocialMedia/Tools/CommentPolicy.html to view CDC’s social media comment policy. Privacy Notice Regarding Third Party Websites: Privacy Notice: The Centers for Disease Control and Prevention uses third-party Web sites to share information and to encourage collaboration with the public. Third-party Web sites are not Government-owned or Government-operated. They are controlled and operated by a third party not affiliated with CDC. The CDC Privacy Policy does not apply to third-party Web sites or applications. To learn more about CDC’s privacy practices, please visit our Privacy Policy at https://www.cdc.gov/other/privacy.html.

National Park Service

nps.gov

Most people know that the National Park Service cares for national parks, a network of over 420 natural, cultural and recreational sites across the nation. The treasures in this system – the first of its kind in the world – have been set aside by the American people to preserve, protect, and share the legacies of this land. People from all around the world visit national parks to experience America's story, marvel at the natural wonders, and have fun. Places like the Grand Canyon, the Statue of Liberty, and Gettysburg are popular destinations, but so too are the hundreds of lesser known yet equally meaningful gems like Rosie the Riveter in California, Boston Harbor Islands in Massachusetts, and Russell Cave in Alabama. The American system of national parks was the first of its kind in the world, and provides a living model for other nations wishing to establish and manage their own protected areas. The park service actively consults with these Nations, sharing what we've learned, and gaining knowledge from the experience of others. Beyond national parks, the National Park Service helps communities across America preserve and enhance important local heritage and close-to-home recreational opportunities. Grants and assistance are offered to register, record and save historic places; create community parks and local recreation facilities; conserve rivers and streams, and develop trails and greenways.

Queensland Government

qld.gov.au

ABOUT US We are the largest and most diverse organisation in our state. We have more than 90 government departments and organisations delivering for Queensland across 4000+ locations, from the Torres Strait to the Gold Coast; Mount Isa to Brisbane. This page is monitored by Queensland Government employees from 8am to 5pm, Monday to Friday. HOUSE RULES — all users must comply with LinkedIn policies and terms of use — please do not post content or comments that could be considered • abusive or obscene, name calling, harassment or personal attacks • defamatory towards a person or people • prejudicial, inflammatory or offensive • deceptive, misleading or false information about an individual, organisation, government or entity • personal or sensitive information about yourself or others • in violation of any intellectual property rights, or any other law or regulation • promotion of a product, business, company or organisation • off-topic or spam, including the same comment posted repeatedly. Any content or comments deemed to fit under these definitions will be deleted. Users found to repeatedly post these types of comments will be banned from this page. You should report any offensive material presented on LinkedIn. Complaints about defamatory digital matter or anything you consider to be offensive should be made to the attention of the Public Sector Commission via our website www.psc.qld.gov.au/contact/customer-compliments-and-complaints. A complaint about defamatory digital matter should contain your name, the matter and where it is located, and that you consider the matter to be defamatory. CURRENT CONDITIONS © The State of Queensland (Public Sector Commission) 2026 Subject to LinkedIn’s Statement of Rights and Responsibilities, all content released on this page is licensed under a Creative Commons Attribution (BY) 2.5 Australia Licence. Permissions may be available beyond the scope of this licence.

UK Home Office

www.gov.uk

At the Home Office, we help to ensure that the country is safe and secure. We’ve been looking after UK citizens since 1782. We are responsible for: - working on the problems caused by illegal drug use - shaping the alcohol strategy, policy and licensing conditions - keeping the United Kingdom safe from the threat of terrorism - reducing and preventing crime, and ensuring people feel safe in their homes and communities - securing the UK border and controlling immigration - considering applications to enter and stay in the UK - issuing passports and visas - supporting visible, responsible and accountable policing by empowering the public and freeing up the police to fight crime - fire prevention and rescue These organisations are all part of the Home Office: - Border Force - HM Passport Office (HMPO) - Immigration Enforcement - UK Visas and Immigration (UKVI)

Rijkswaterstaat

rijkswaterstaat.nl

Rijkswaterstaat is de uitvoeringsorganisatie van het Ministerie van Infrastructuur en Waterstaat. We beheren en ontwikkelen de rijkswegen, -vaarwegen en –wateren en zetten in op een duurzame leefomgeving. Samen met andere organisaties werken we aan een land dat beschermd is tegen overstromingen. Waar voldoende groen is, en voldoende en schoon water. En waar je vlot en veilig van A naar B kunt. Samenwerken aan een veilig, leefbaar en bereikbaar Nederland. Dat is Rijkswaterstaat. Bij Rijkswaterstaat werk je mee aan de toekomst van Nederland met de ruimte om jezelf te blijven ontwikkelen. Gun jezelf een baan met toekomst. Gun jezelf Rijkswaterstaat.

City of Cape Town

capetown.gov.za

Cape Town, or the Mother City, is South Africa’s oldest city, its second-most populous and the legislative capital. It is made up of a diverse population, a rich history, world-famous tourist attractions and an exciting calendar of international and local events. More than 231 councillors and 26 225 staff serve 4 million residents across a sprawling and cosmopolitan metro of 2 500 square kilometres. The City provides all the services normally associated with a full-service municipality, such as water, electricity, waste removal, sanitation, new infrastructure, roads, public spaces, facilities, housing developments, the upgrade of informal settlements and existing infrastructure, clinics and more. To meet the current and future needs of its residents, the City of Cape Town has formulated strategies and policies to guide development and growth. Central to these is the Integrated Development Plan (IDP), which is a five-year plan that informs the City’s policy and budget decisions. The City’s strong sense of community makes it one of the best places to live, work and raise a family. We offer rewarding career opportunities, great benefits and competitive salaries. New opportunities are posted at www.capetown.gov.za/careers.

Loading…

NEWS

CETESB - Companhia Ambiental do Estado de São Paulo CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

August 13, 2024 07:00 AM

CETESB Publishes New Board Decision on the Management of Contaminated Areas

The Environmental Agency of the State of São Paulo ( Companhia Ambiental do Estado de São Paulo - CETESB) recently published in the Official...

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-18556

SUMMARY

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://uptime.n-able.com/

CVE-2026-55735

SUMMARY

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55734

SUMMARY

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55733

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-54894

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…