What is Cybersecurity and Infrastructure Security Agency's cybersecurity risk score?

Cybersecurity and Infrastructure Security Agency has an AI-generated cybersecurity risk score of 165 out of 1000, indicating a Critical security posture according to Rankiteo's assessment.

How many security incidents has Cybersecurity and Infrastructure Security Agency experienced?

According to Rankiteo, Cybersecurity and Infrastructure Security Agency currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has Cybersecurity and Infrastructure Security Agency been affected by any supply chain cyber incidents ?

According to Rankiteo, Cybersecurity and Infrastructure Security Agency has been affected by multiple supply chain cyber incidents. The affected supply chain sources and their corresponding incident IDs are: SolarWinds (Incident ID: SOL1780734225) LiteSpeed Technologies (Incident ID: CISLIT1779899124) Nightwing (Incident ID: CISNIG1779150346) Arista Networks (Incident ID: ARICIS1781094274) F5 (Incident ID: F51774844643) Microsoft Security Response Center (Incident ID: MIC1773980784) SolarWinds (Incident ID: SOL1770194061) Tata Group (Incident ID: MIC1773923106) Cisco (Incident ID: CIS1766051696) Notepad++ (Incident ID: NOT1765821620) Nightwing (Incident ID: NIGCIS1779216319) Cisco (Incident ID: US-1776976007) Microsoft Security Response Center (Incident ID: CISMIC1771331760) VMware (Incident ID: BRO1769309760) Fortinet (Incident ID: CISSYMFBIFOR1768715192)

Does Cybersecurity and Infrastructure Security Agency have SOC 2 Type 1 certification ?

According to Rankiteo, Cybersecurity and Infrastructure Security Agency is not certified under SOC 2 Type 1.

Does Cybersecurity and Infrastructure Security Agency have SOC 2 Type 2 certification ?

According to Rankiteo, Cybersecurity and Infrastructure Security Agency does not hold a SOC 2 Type 2 certification.

Does Cybersecurity and Infrastructure Security Agency comply with GDPR ?

According to Rankiteo, Cybersecurity and Infrastructure Security Agency is not listed as GDPR compliant.

Does Cybersecurity and Infrastructure Security Agency have PCI DSS certification ?

According to Rankiteo, Cybersecurity and Infrastructure Security Agency does not currently maintain PCI DSS compliance.

Does Cybersecurity and Infrastructure Security Agency comply with HIPAA ?

According to Rankiteo, Cybersecurity and Infrastructure Security Agency is not compliant with HIPAA regulations.

Does Cybersecurity and Infrastructure Security Agency have ISO 27001 certification ?

According to Rankiteo,Cybersecurity and Infrastructure Security Agency is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does Cybersecurity and Infrastructure Security Agency operate in ?

Cybersecurity and Infrastructure Security Agency operates primarily in the Government Administration industry.

How many employees does Cybersecurity and Infrastructure Security Agency have ?

Cybersecurity and Infrastructure Security Agency employs approximately 1,668 people worldwide.

Does Cybersecurity and Infrastructure Security Agency own any subsidiaries ?

Cybersecurity and Infrastructure Security Agency presently has no subsidiaries across any sectors.

How many LinkedIn followers does Cybersecurity and Infrastructure Security Agency have ?

Cybersecurity and Infrastructure Security Agency's official LinkedIn profile has approximately 643,880 followers.

What is the NAICS classification code for Cybersecurity and Infrastructure Security Agency ?

Cybersecurity and Infrastructure Security Agency is classified under the NAICS code 92, which corresponds to Public Administration.

Does Cybersecurity and Infrastructure Security Agency have a Crunchbase profile ?

No, Cybersecurity and Infrastructure Security Agency does not have a profile on Crunchbase.

Does Cybersecurity and Infrastructure Security Agency have a LinkedIn profile ?

Yes, Cybersecurity and Infrastructure Security Agency maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/cisagov.

How many peer or competitor companies does Cybersecurity and Infrastructure Security Agency have ?

Cybersecurity and Infrastructure Security Agency has an estimated 13,085 peer or competitor companies worldwide.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

CISA

Boost Score +25 with badge (5 left)

165

/1000

Critical

190

/1000

Critical

Cybersecurity and Infrastructure Security Agency Vendor Cyber Rating & Cyber Score

cisa.gov

Add Your Compliance Badge

America's Cyber Defense Agency and National Coordinator for Critical Infrastructure Security & Resilience. Likes, reshares, follows ≠ endorsements.

CISA A.I CyberSecurity Scoring

Scoring History

CISA

Cybersecurity and Infrastructure Security Agency CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

Cybersecurity and I...

Vulnerability

100

6/2026

SolarWinds

SOL1780734225

Cybersecurity and I...

Vulnerability

100

5/2026

LiteSpeed Techn...

CISLIT177989912...

U.S. Department of ...

Cyber Attack

100

5/2026

US-1782931085

Cybersecurity and I...

Breach

100

5/2026

Nightwing

CISNIG177915034...

Cybersecurity and I...

Vulnerability

100

5/2026

Arista Networks

ARICIS178109427...

Cybersecurity and I...

Vulnerability

100

4/2026

LINCISMIC177793...

Cybersecurity and I...

Vulnerability

100

3/2026

F51774844643

Cybersecurity and I...

Vulnerability

100

3/2026

Microsoft Secur...

MIC1773980784

U.S. Department of ...

Cyber Attack

100

2/2026

SCOUS-177246174...

Cybersecurity and I...

Cyber Attack

100

2/2026

CISPAL177036707...

Cybersecurity and I...

Vulnerability

100

2/2026

SolarWinds

SOL1770194061

Cybersecurity and I...

Breach

2/2026

CIS1770197400

U.S. Department of ...

Vulnerability

100

1/2026

Tata Group

MIC1773923106

U.S. Department of ...

Breach

1/2026

US-CUSU-S176859...

U.S. Immigration an...

Breach

100

1/2026

HOMU-S176832898...

Cybersecurity and I...

Cyber Attack

100

1/2026

FBICISUS-UNI176...

U.S. Department of ...

Vulnerability

100

12/2025

US-1767173563

Cybersecurity and I...

Vulnerability

100

12/2025

Cisco

CIS1766051696

Cybersecurity and I...

Vulnerability

12/2025

Notepad++

NOT1765821620

Cybersecurity and I...

Breach

11/2025

USC373373711252...

Cybersecurity and I...

Breach

100

11/2025

Nightwing

NIGCIS177921631...

Cybersecurity and I...

Vulnerability

10/2025

VERCIS177923186...

Cybersecurity and I...

Cyber Attack

100

9/2025

Cisco

US-1776976007

Cybersecurity and I...

Breach

9/2025

FEM319293109302...

Cybersecurity and I...

Cyber Attack

100

8/2025

CIS1770890877

U.S. Department of ...

Ransomware

100

7/2025

US-1771976815

U.S. Department of ...

Cyber Attack

100

7/2025

US-NOZTRE177433...

Cybersecurity and I...

Cyber Attack

100

7/2025

CIS1765368172

Cybersecurity and I...

Breach

7/2025

FEM180271810022...

Cybersecurity and I...

Breach

6/2025

FEM536235310012...

Cybersecurity and I...

Cyber Attack

100

6/2025

CIS1765251340

Cybersecurity and I...

Breach

5/2025

CIS1779207877

Cybersecurity and I...

Cyber Attack

100

5/2025

CIS119221110142...

Cybersecurity and I...

Cyber Attack

100

4/2025

US-598525911262...

Cybersecurity and I...

Breach

100

1/2025

CIS001012825

U.S. Immigration an...

Breach

1/2025

UNIU-S177046516...

Cybersecurity and I...

Cyber Attack

100

12/2024

CIS000122124

Cybersecurity and I...

Vulnerability

100

12/2024

US-001010525

Cybersecurity and I...

Vulnerability

100

10/2024

Microsoft Secur...

CISMIC177133176...

Cybersecurity and I...

Breach

8/2024

FEM309233009302...

Cybersecurity and I...

Vulnerability

100

8/2024

CIS005080624

Cybersecurity and I...

Cyber Attack

100

6/2024

CIS000080624

Cybersecurity and I...

Cyber Attack

100

6/2024

FEM153321510062...

Cybersecurity and I...

Cyber Attack

100

1/2024

CIS1765238766

Cybersecurity and I...

Vulnerability

100

1/2024

VMware

BRO1769309760

Cybersecurity and I...

Ransomware

10/2023

CYB2047151023

Cybersecurity and I...

Vulnerability

9/2023

CIS1769475575

Cybersecurity and I...

Breach

100

5/2023

DEP190311909232...

Cybersecurity and I...

Breach

100

5/2023

US-464164610052...

Cybersecurity and I...

Ransomware

100

1/2023

CIS427092125

Cybersecurity and I...

Breach

12/2022

USI233311222

Cybersecurity and I...

Ransomware

100

7/2021

CISTHEFBI177484...

Cybersecurity and I...

Cyber Attack

6/2021

Fortinet

CISSYMFBIFOR176...

Cybersecurity and I...

Ransomware

100

6/2020

US-341071125

Cybersecurity and I...

Vulnerability

100

6/2018

CIS000122224

Cybersecurity and I...

Breach

01/2018

USD331181223

Cybersecurity and I...

Breach

100

6/2017

FEM74612323

Cybersecurity and I...

Data Leak

02/2016

USD181261023

Cybersecurity and I...

Cyber Attack

100

6/2015

CIS033210310112...

Loading…

A.I.

CISA Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for CISA

Incidents vs Government Administration Industry Avg (This Year)

Cybersecurity and Infrastructure Security Agency has 663.89% more incidents than the average of same-industry companies with at least one recorded incident.

Incidents vs All-Companies Average (This Year)

Cybersecurity and Infrastructure Security Agency has 957.69% more incidents than the average of all companies with at least one recorded incident.

Incident Types CISA vs Government Administration Industry Avg (This Year)

Cybersecurity and Infrastructure Security Agency reported 11 incidents this year: 2 cyber attacks, 0 ransomware, 7 vulnerabilities, 2 data breaches, compared to industry peers with at least 1 incident.

Incident History - CISA (X = Date, Y = Severity)

Loading…

SUBSIDIARY

Cybersecurity and Infrastructure Security Agency Subsidiaries

CISA

Government Administration

Website: http://www.cisa.gov

Company Size: 1,001-5,000 employees

U.S. Department of Homeland SecurityGovernment Administration

U.S. Secret ServiceLaw Enforcement

U.S. Secret Service - Washington Field OfficeLaw Enforcement

U.S. Secret Service - New York Field OfficeLaw Enforcement

U.S. Secret Service - Chicago Field OfficeLaw Enforcement

U.S. Secret Service - Atlanta Field OfficeLaw Enforcement

U.S. Secret Service - Miami Field OfficeLaw Enforcement

U.S. Secret Service - Los Angeles Field OfficeLaw Enforcement

USCISGovernment Administration

FEMAGovernment Administration

FEMA Region 6Government Administration

National Flood Insurance Program FEMAInsurance

FEMA Region 5Government Administration

National Disaster & Emergency Management UniversityGovernment Administration

FEMA Region 8Government Administration

FEMA Region 2Emergency and Relief Services

FEMA Region 4Government Administration

FEMA Region 7Government Administration

FEMA National Advisory Council (NAC)Government Administration

Transportation Security Administration (TSA)Government Administration

Federal Law Enforcement Training CentersLaw Enforcement

U.S. Coast GuardArmed Forces

U. S. Coast Guard Office of LeadershipArmed Forces

U.S. Coast Guard Maritime CommonsMaritime Transportation

USCG Contracting & Procurement EnterpriseGovernment Administration

U.S. Coast Guard CiviliansGovernment Administration

U.S. Immigration and Customs Enforcement (ICE)Law Enforcement

U.S. Customs and Border ProtectionGovernment Administration

CBP Office of TradeGovernment Administration

CBP Office of Professional ResponsibilityGovernment Administration

U.S. Department of Homeland Security, Office of Intelligence and Analysis, Private Sector EngagementGovernment Administration

DHS Science and Technology DirectorateGovernment Administration

Department of Homeland Security Office of the Chief Financial OfficerGovernment Administration

Office of the Citizenship and Immigration Services Ombudsman (CIS Ombudsman)Government Administration

CISA Alumni GroupComputer and Network Security

Loading…

Cybersecurity and Infrastructure Security Agency Similar Companies

Transportation Security Administration (TSA)

tsa.gov

The Transportation Security Administration (TSA) is a component agency of the U.S. Department of Homeland Security (DHS), committed to securing the nation’s transportation systems to ensure safe and efficient travel for all. Our mission is to protect the American people by preventing threats and disruptions in the transportation sector, while enhancing the overall passenger experience. 🔹 Mission: Safeguard transportation systems and prevent security threats 🔹 Vision: Achieve a secure and resilient transportation network 🔹 Values: Integrity, Excellence, Accountability, and Innovation More than 60,000 people around the world make up #TeamTSA and ensure the safety of millions of people each day as they travel by plane, train, automobile or ferry. From the officers you see on the frontlines to our cybersecurity and mission support teams, we’re working hard to combat evolving threats and keep you safe. Join us in our commitment to a more secure travel experience. For more information, visit tsa.gov.

GSA

gsa.gov

General Services Administration (GSA) is an independent agency of the United States government established in 1949 to help manage and support the basic functioning of federal agencies. Our organization includes the Public Buildings Service (PBS), Federal Acquisition Service (FAS), and a variety of Service and Staff Offices. Learn more about our organization at gsa.gov. Our Mission GSA's mission is to deliver value and savings in real estate, acquisition, technology, and other mission-support services across government. Our Vision Effective and efficient government for the American people. Our Values Service, Accountability, and Innovation ----------- You can also find us on these social media sites: Twitter: https://twitter.com/usgsa Facebook: https://www.facebook.com/GSA/ Instagram: https://www.instagram.com/usgsa/

Københavns Kommune

kk.dk

Københavns Kommune er Danmarks største arbejdsplads med ca. 45.000 medarbejdere. Vi udvikler hovedstaden og servicerer over 500.000 københavnere. Vores mål er at fastholde og udvikle København som en af verdens bedste byer at bo i – og skabe øget vækst gennem viden, innovation og beskæftigelse. Find dit næste job her eller på www.kk.dk/job På vores karrieresite www.kk.dk/job kan du bl.a. se alle vores ledige stillinger og tilmelde dig vores jobagent. Her kan du også læse om vores medarbejdergoder.

eThekwini Municipality

durban.gov.za

EThekwini Municipality is a Metropolitan Municipality found in the South African province of KwaZulu-Natal. Home to the world-famous city of Durban. EThekwini is the largest City in the province and the third largest city in the country. It is a sophisticated cosmopolitan city of over 3 468 088 people. It is known as the home of Africa's best-managed, busiest port and is also a major centre of tourism because of the city's warm subtropical climate and extensive beaches. The eThekwini Municipality is an employer of choice, with excellent working conditions and competitive salary packages for employees. The Municipality is committed to creating a great place to work by creating development opportunities for employees to grow. Working for eThekwini Municipality will give you a chance to make a difference in people’s lives and become part of our team to make Durban the most caring and liveable city in Africa. Some facts about eThekwini Municipality: 1. Known as South Africa’s Playground – plenty of places to visit and activities to do 2. First African city to host the Commonwealth Games 3. Historically rich with Heritage sites for Nelson Mandela and Mahatma Ghandi 4. Home to the Comrades Marathon – The worlds’ largest ultra-marathon 5. The world’s tallest bungee swing at the Moses Mabhida stadium 6. Durban Aliwal Shoal – a world top diving site 7. Durban harbour - 9th largest harbour in the world - busiest container port in Africa 8. Africa’s first Aerotropolis – Trade Port with direct links globally 9. One of the top surfing destinations in South Africa 10. Ushaka Marine World – Biggest Aquarium in Africa

U.S. Department of Education

ed.gov

Our mission is to promote student achievement and preparation for global competitiveness by fostering educational excellence and ensuring equal access. ED is dedicated to: • Establishing policies on federal financial aid for education, and distributing as well as monitoring those funds. • Collecting data on America's schools and disseminating research. • Focusing national attention on key educational issues. • Prohibiting discrimination and ensuring equal access to education.

Queensland Government

qld.gov.au

ABOUT US We are the largest and most diverse organisation in our state. We have more than 90 government departments and organisations delivering for Queensland across 4000+ locations, from the Torres Strait to the Gold Coast; Mount Isa to Brisbane. This page is monitored by Queensland Government employees from 8am to 5pm, Monday to Friday. HOUSE RULES — all users must comply with LinkedIn policies and terms of use — please do not post content or comments that could be considered • abusive or obscene, name calling, harassment or personal attacks • defamatory towards a person or people • prejudicial, inflammatory or offensive • deceptive, misleading or false information about an individual, organisation, government or entity • personal or sensitive information about yourself or others • in violation of any intellectual property rights, or any other law or regulation • promotion of a product, business, company or organisation • off-topic or spam, including the same comment posted repeatedly. Any content or comments deemed to fit under these definitions will be deleted. Users found to repeatedly post these types of comments will be banned from this page. You should report any offensive material presented on LinkedIn. Complaints about defamatory digital matter or anything you consider to be offensive should be made to the attention of the Public Sector Commission via our website www.psc.qld.gov.au/contact/customer-compliments-and-complaints. A complaint about defamatory digital matter should contain your name, the matter and where it is located, and that you consider the matter to be defamatory. CURRENT CONDITIONS © The State of Queensland (Public Sector Commission) 2026 Subject to LinkedIn’s Statement of Rights and Responsibilities, all content released on this page is licensed under a Creative Commons Attribution (BY) 2.5 Australia Licence. Permissions may be available beyond the scope of this licence.

Correios

correios.com.br

Empresa Brasileira de Correios e Telégrafos foi criada como empresa em 1969 por decreto lei. Hoje conta com mais de 100.000 empregados, tem presença em todos os municípios do Brasil. NEGÓCIO: Soluções que aproximam. MISSÃO: Fornecer soluções acessíveis e confiáveis para conectar pessoas, instituições e negócios, no Brasil e no mundo. VISÃO: Ser uma empresa de classe mundial. VALORES: A. Ética B. Meritocracia C. Respeito às Pessoas D. Compromisso com o Cliente E. Sustentabilidade

State of Oregon

cb oregon.gov

Official LinkedIn page for the state of Oregon. Oregon is a state in the Pacific Northwest region of the United States. It is located on the Pacific coast, with Washington to the north, California to the south, Nevada on the southeast and Idaho to the east. The Columbia and Snake rivers delineate much of Oregon's northern and eastern boundaries, respectively. The area was inhabited by many indigenous tribes before the arrival of traders, explorers, and settlers who formed an autonomous government in Oregon Country in 1843. The Oregon Territory was created in 1848, and Oregon became the 33rd state on February 14, 1859.

State of Tennessee

tn.gov

State government is the largest employer in Tennessee, with approximately 43,500 employees in the three branches of government. The State of Tennessee has approximately 1,300 different job classifications in areas such as administrative, health services, historic preservation, legal, agriculture, counseling, and medical. If you are interested in becoming a data scientist, attorney, nurse, wildlife officer, physician, education consultant, trooper, computer programmer or an epidemiologist, explore all of the job opportunities the State of Tennessee has to offer. The State is looking to recruit, retain, and reward a talented workforce through the implementation of a merit-based pay system. Stop back often for news, updates and opportunities -- thanks for visiting!

Loading…

NEWS

Cybersecurity and Infrastructure Security Agency CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

March 27, 2026 02:27 AM

The Nation’s Top Cybersecurity Agency Is Bleeding Employees

CISA is operating with more than 1000 vacancies and 60% of its remaining staff furloughed or unable to work.

Read Article

March 26, 2026 10:58 PM

ODNI tackles AI, threat hunting, app cybersecurity in year-one tech review

It's the first significant cybersecurity-related announcement under Director of National Intelligence Tulsi Gabbard. By Tim Starks.

Read Article

March 26, 2026 09:29 PM

OMB convenes agencies, industry to talk AI for cyber defense

OMB wants agencies to lead the way in adopting AI for cyber defense, including continuous event monitoring, forensics and incident response.

Read Article

March 26, 2026 09:07 PM

U.S. CISA adds a Langflow flaw to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Langflow to its Known Exploited Vulnerabilities catalog.

Read Article

March 26, 2026 07:17 PM

CISA: New Langflow flaw actively exploited to hijack AI workflows

The Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are actively exploiting a critical vulnerability...

Read Article

March 26, 2026 05:23 PM

Former NSA chiefs worry American offensive edge in cybersecurity is slipping

A systemic numbness to cyberattacks has exposed the U.S. economy and its institutions to ever-widening threats. Retired four-star military...

Read Article

March 26, 2026 03:21 PM

Cyber risks against US escalate amid DHS shutdown, says CISA official

Cybersecurity risks faced by the U.S. were noted by Cybersecurity and Infrastructure Security Agency Acting Director Nick Andersen to...

Read Article

March 26, 2026 02:40 PM

Understanding the Quantum Threat & How It Is Transforming the Future of Cybersecurity

Advancements in quantum computing are shaping the future of cybersecurity across industries, including the federal market.

Read Article

March 26, 2026 02:45 AM

CISA eyes plan for more than 300 new hires

The Cybersecurity and Infrastructure Security Agency, after a year of workforce reductions that has left CISA's ranks depleted,...

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-67595

SUMMARY

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript enabled. The payload establishes a WebSocket connection to a hardcoded command-and-control endpoint, installs a password-field keylogger using MutationObserver to capture dynamically added inputs, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite the rendered page.

Published

Date2026-07-29

Updated

Date2026-07-29

RISK INFORMATION (Score: 8.1)

cvss3

Base Score: 8.1

Complexity: HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

cvss4

Base Score: 9.2

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

5.9

Exploitability

2.2

REFERENCES

CVE-2026-15157

SUMMARY

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

Published

Date2026-07-29

Updated

Date2026-07-29

RISK INFORMATION (Score: 4.2)

cvss3

Base Score: 4.2

Complexity: HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Impact Score

2.5

Exploitability

1.6

REFERENCES

CVE-2026-14643

SUMMARY

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.

Published

Date2026-07-29

Updated

Date2026-07-29

RISK INFORMATION (Score: 5.9)

cvss3

Base Score: 5.9

Complexity: HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Impact Score

3.6

Exploitability

2.2

REFERENCES

CVE-2025-69949

SUMMARY

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email.

Published

Date2026-07-29

Updated

Date2026-07-29

RISK INFORMATION (Score: )

Impact Score

Exploitability

REFERENCES

CVE-2025-69945

SUMMARY

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1.

Published

Date2026-07-29

Updated

Date2026-07-29

RISK INFORMATION (Score: )

Impact Score

Exploitability

REFERENCES

https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-edit-patient.php-editid-sqli/20250811-hospital-management-system-edit-patient.php-editid-sqli.md

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…