What is the official website of Department for Culture, Media and Sport ?

The official website of Department for Culture, Media and Sport is https://www.civil-service-careers.gov.uk/working-for-dcms-hub/.

What is Department for Culture, Media and Sport's cybersecurity risk score?

Department for Culture, Media and Sport has an AI-generated cybersecurity risk score of 658 out of 1000, indicating a Weak security posture according to Rankiteo's assessment.

How many security incidents has Department for Culture, Media and Sport experienced?

According to Rankiteo, Department for Culture, Media and Sport currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has Department for Culture, Media and Sport been affected by any supply chain cyber incidents ?

According to Rankiteo, Department for Culture, Media and Sport has been affected by a supply chain cyber incident involving Fortinet, with the incident ID FORGOV1783297461.

Does Department for Culture, Media and Sport have SOC 2 Type 1 certification ?

According to Rankiteo, Department for Culture, Media and Sport is not certified under SOC 2 Type 1.

Does Department for Culture, Media and Sport have SOC 2 Type 2 certification ?

According to Rankiteo, Department for Culture, Media and Sport does not hold a SOC 2 Type 2 certification.

Does Department for Culture, Media and Sport comply with GDPR ?

According to Rankiteo, Department for Culture, Media and Sport is not listed as GDPR compliant.

Does Department for Culture, Media and Sport have PCI DSS certification ?

According to Rankiteo, Department for Culture, Media and Sport does not currently maintain PCI DSS compliance.

Does Department for Culture, Media and Sport comply with HIPAA ?

According to Rankiteo, Department for Culture, Media and Sport is not compliant with HIPAA regulations.

Does Department for Culture, Media and Sport have ISO 27001 certification ?

According to Rankiteo,Department for Culture, Media and Sport is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does Department for Culture, Media and Sport operate in ?

Department for Culture, Media and Sport operates primarily in the Government Administration industry.

How many employees does Department for Culture, Media and Sport have ?

Department for Culture, Media and Sport employs approximately 1,514 people worldwide.

Does Department for Culture, Media and Sport own any subsidiaries ?

Department for Culture, Media and Sport presently has no subsidiaries across any sectors.

How many LinkedIn followers does Department for Culture, Media and Sport have ?

Department for Culture, Media and Sport's official LinkedIn profile has approximately 126,858 followers.

What is the NAICS classification code for Department for Culture, Media and Sport ?

Department for Culture, Media and Sport is classified under the NAICS code 92, which corresponds to Public Administration.

Does Department for Culture, Media and Sport have a Crunchbase profile ?

No, Department for Culture, Media and Sport does not have a profile on Crunchbase.

Does Department for Culture, Media and Sport have a LinkedIn profile ?

Yes, Department for Culture, Media and Sport maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/dcmsgovuk.

How many cybersecurity incidents has Department for Culture, Media and Sport experienced ?

As of August 2, 2026, Rankiteo reports that Department for Culture, Media and Sport has experienced 27 cybersecurity incidents.

How many peer or competitor companies does Department for Culture, Media and Sport have ?

Department for Culture, Media and Sport has an estimated 13,099 peer or competitor companies worldwide.

What types of cybersecurity incidents has Department for Culture, Media and Sport faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability, Breach, Ransomware and Cyber Attack.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

DCMS

Boost Score +25 with badge (5 left)

658

/1000

Weak

683

/1000

Weak

Department for Culture, Media and Sport Vendor Cyber Rating & Cyber Score

civil-service-careers.gov.uk

Add Your Compliance Badge

The Department for Culture, Media and Sport will focus on supporting culture, arts, media, sport, tourism and civil society across every part of England — recognising the UK’s world-leading position in these areas and the importance of these sectors in contributing so much to our economy, way of life and our reputation around the world. The department champions sport for all at every level, support our world-leading cultural and creative industries and enhance the cohesiveness of our communities. DCMS is a ministerial department, supported by 42 agencies and public bodies.

DCMS A.I CyberSecurity Scoring

Scoring History

DCMS

Department for Culture, Media and Sport CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

UK Ministry of Defe...

Breach

100

7/2026

UK-1785371161

Foreign and Commonw...

Cyber Attack

100

7/2026

Fortinet

FORGOV178329746...

Cabinet Office

Breach

5/2026

CAB1777832879

Department for Cult...

Vulnerability

12/2025

DCM1765433387

Department for Cult...

Breach

11/2025

UK-523475211042...

Department for Cult...

Cyber Attack

100

10/2025

UK-556215510202...

Foreign and Commonw...

Breach

10/2025

FOR1766412101

Department for Cult...

Ransomware

100

9/2025

DCM1764770468

Department for Cult...

Breach

100

8/2025

UK-841081625

Department for Cult...

Breach

6/2025

HMR745060625

UK Home Office

Breach

4/2025

UK-1777581082

Department for Cult...

Breach

100

7/2024

UK-421016421104...

Department for Cult...

Breach

100

6/2024

UK-169221610212...

Department for Cult...

Breach

100

4/2024

UK-493314910132...

Department for Cult...

Breach

100

8/2023

UK-707072025

Department for Cult...

Breach

100

7/2023

UK-221002221104...

Department for Cult...

Cyber Attack

100

01/2023

DEP225811123

Department for Cult...

Breach

100

6/2022

UK-289342811142...

Department for Cult...

Breach

100

2/2022

UK-503305010202...

Department for Cult...

Breach

1/2022

UK-559215509112...

Department for Cult...

Breach

11/2021

GOV1527121122

Department for Cult...

Breach

100

10/2021

UK-576295710232...

HM Revenue & Custom...

Cyber Attack

9/2021

HMR1782752907

Department for Cult...

Breach

100

8/2021

UK-552175511242...

Department for Cult...

Breach

100

6/2021

UK-089380810032...

Department for Cult...

Cyber Attack

100

09/2015

NAT233920422

Department for Cult...

Breach

100

6/2010

UK-069420609202...

Loading…

A.I.

DCMS Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for DCMS

Incidents vs Government Administration Industry Avg (This Year)

No incidents recorded for Department for Culture, Media and Sport in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for Department for Culture, Media and Sport in 2026.

Incident Types DCMS vs Government Administration Industry Avg (This Year)

No incidents recorded for Department for Culture, Media and Sport in 2026.

Incident History - DCMS (X = Date, Y = Severity)

Loading…

SUBSIDIARY

Department for Culture, Media and Sport Subsidiaries

DCMS

Government Administration

Website: https://www.civil-service-careers.gov.uk/working-for-dcms-hub/

Company Size: 501-1,000 employees

UK Civil ServiceGovernment Administration

Department for EducationGovernment Administration

TeachingPrimary and Secondary Education

Buying for SchoolsGovernment Administration

DfE Digital, Data and TechnologyGovernment Relations Services

Skills PartnerGovernment Administration

UK Ministry of DefenceDefense and Space Manufacturing

Defence Equipment & Support (DE&S)Defense and Space Manufacturing

Defence ProcurementDefense & Space

UK Home OfficeGovernment Administration

HM Revenue & CustomsGovernment Administration

Department of Health and Social CareGovernment Relations Services

OfstedGovernment Administration

Department for Business and TradeGovernment Administration

Business SupportGovernment Relations

GREAT Trade and InvestmentWholesale Import and Export

UK Business and Trade - North AmericaGovernment Relations Services

Department for Work and Pensions (DWP)Government Administration

Disability ConfidentGovernment Administration

See PotentialGovernment Administration

Cabinet OfficeGovernment Administration

GOV.UKGovernment Relations Services

HM Government Public AppointmentsGovernment Administration

Department for Transport (DfT), United KingdomGovernment Administration

Foreign and Commonwealth OfficeGovernment Administration

Department for International Development (DFID)Government Administration

UK-Africa Investment Summit 2020Government Administration

Department for Environment, Food and Rural AffairsGovernment Administration

Defra digital, data, technology and securityIT Services and IT Consulting

Defra Public AppointmentsGovernment Administration

OfgemUtilities

DstlDefense and Space Manufacturing

Data Science ChallengeGovernment Administration

Food Standards AgencyGovernment Administration

Starting a Food BusinessFood & Beverages

UK Export FinanceFinancial Services

Competition and Markets AuthorityGovernment Administration

Crown Prosecution ServiceLaw Practice

OfwatUtilities

Regulators’ Alliance for Progressing Infrastructure Development (RAPID)Utilities

OfqualGovernment Administration

Attorney General's Office (UK)Government Administration

Northern Ireland OfficeGovernment Administration

Valuation Office AgencyGovernment Administration

Charity Commission for England and WalesGovernment Administration

Government Legal DepartmentLegal Services

Office for National StatisticsGovernment Administration

Government Statistical ServiceGovernment Administration

Civil Service Fast Stream Statisticians' OutreachGovernment Administration

Census2021Government Administration

NS&IFinancial Services

NS&I Government Payment ServicesGovernment Administration

UK Statistics Authority Government Administration

Office of Rail and Road (ORR)Truck Transportation

HM TreasuryPublic Policy Offices

Office of Financial Sanctions Implementation (OFSI)Government Administration

Forestry CommissionGovernment Administration

Scotland OfficeGovernment Administration

UK Government Wales/Llywodraeth DU CymruGovernment Administration

Government Actuary's DepartmentGovernment Administration

HM Land RegistryGovernment Administration

Ministry of Housing, Communities and Local Government - LegacyGovernment Administration

Northern PowerhouseCivic and Social Organizations

Ministry of Housing, Communities and Local Government - LegacyGovernment Administration

Infrastructure and Projects Authority (IPA)Government Administration

National Crime Agency (NCA)Law Enforcement

UK Financial Intelligence Unit (UKFIU)Law Enforcement

Department for Science, Innovation and TechnologyGovernment Administration

Careers at the Department for Science, Innovation and TechnologyGovernment Administration

Loading…

Department for Culture, Media and Sport Similar Companies

Council Careers Victoria

asn.au

Victorian local government jobs offer opportunities for people with diverse skills. The sector delivers more than 100 services and employs staff in the areas of health and community care, corporate and business support, engineering, planning and community development, and environment and emergency management. Local government offers you the opportunity to: • work directly with the community • work in any location across the state • be involved in on-going learning and development • negotiate flexible working arrangements • take part in employee health and recreation programs • undertake further study.

United States Postal Service

usps.com

As the United States Postal Service continues its evolution as a forward-thinking, fast-acting company capable of providing quality products and services for its customers, it continues to remember and celebrate its roots as the first national network of communications that literally bound a nation together. Ours is a proud heritage built on a simple yet profound mission: Bind the nation together. Connect every American, every door, every business, everywhere through the simple act of delivering mail and packages. This idea of universal service is at the heart of the $1.4 trillion industry that employs more than 7.5 million people and drives commerce, plays an integral part in every American community and remains the greatest value of any post in the world. The Postal Service delivers more mail to more addresses in a larger geographical area than any other post in the world. The Postal Service delivers to more than 157 million addresses in every state, city and town in this country. Everyone living in the United States and its territories has access to postal products and services and pays the same postage regardless of their location. The Postal Service receives no tax dollars for operating expenses and relies on the sale of postage, products and services to fund its operations. Facebook: www.facebook.com/usps Twitter: www.twitter.com/usps Instagram: www.instagram.com/uspostalservice Pinterest: www.pinterest.com/uspsstamps YouTube: www.youtube.com/usps Corporate Blog: www.uspsblog.com This profile, while affiliated with the U.S. Postal Service®, is not an official customer service page. Please use one of the methods described below to receive assistance. Get help on twitter @USPSHelp or call 800-275-8777or go to go.usa.gov/help Thank you

Centers for Disease Control and Prevention

cdc.gov

CDC works 24/7 keeping America safe from health, safety and security threats, both foreign and domestic. Whether diseases start at home or abroad, are chronic or acute, curable or preventable, human error or deliberate attack, CDC fights it and supports communities and citizens to prevent it. CDC is the nation’s health protection agency - saving lives, protecting people from health threats, and saving money through prevention. For more information, please go to: http://www.cdc.gov/ Comment Policy: Please visit http://www.cdc.gov/SocialMedia/Tools/CommentPolicy.html to view CDC’s social media comment policy. Privacy Notice Regarding Third Party Websites: Privacy Notice: The Centers for Disease Control and Prevention uses third-party Web sites to share information and to encourage collaboration with the public. Third-party Web sites are not Government-owned or Government-operated. They are controlled and operated by a third party not affiliated with CDC. The CDC Privacy Policy does not apply to third-party Web sites or applications. To learn more about CDC’s privacy practices, please visit our Privacy Policy at https://www.cdc.gov/other/privacy.html.

Land Niedersachsen

niedersachsen.de

Der Arbeitgeber Niedersachsen vereint über 2000 Dienststellen mit einem gemeinsamen Ziel: Wir gestalten das Leben in Niedersachsen verantwortungsvoll und zukunftsorientiert. Als der größte Arbeitgeber im Land Niedersachsen bieten wir sichere Arbeitsplätze, sinnstiftende Aufgaben und vielfältige Einsatzbereiche - von Verwaltung über Umwelt, Handwerk, Bildung oder IT bis hin zur Polizei. Wir suchen Menschen mit Engagement und dem Wunsch das Land Niedersachsen mitzugestalten. Ob Berufseinstieg, Quereinstieg oder Laufbahnentwicklung - bei uns findest du deine Perspektive. Vielfalt, Vereinbarkeit und Verlässlichkeit stehen bei uns an erster Stelle. Folge uns, um mehr über aktuelle Stellenangebote, Karrierewege und echte Einblicke in den niedersächsischen Landesdienst zu erfahren. Impressum: https://karriere.niedersachsen.de/impressum.html Datenschutz: https://karriere.niedersachsen.de/datenschutz.html

Belastingdienst

belastingdienst.nl

De organisatie bestaat uit diverse onderdelen, waaronder de Belastingdienst, Douane, Toeslagen, FIOD en enkele facilitaire organisaties. Met ruim 30.000 medewerkers werken we in kantoren die verspreid zijn over het hele land. Gezamenlijk heffen, innen en controleren we belastingen. Daarnaast zorgen we ook voor het uitbetalen van toeslagen. En zijn we verantwoordelijk voor douanetaken en het opsporen van fraude. De Belastingdienst is een organisatie die 24 uur per dag, 7 dagen per week in dienst staat van de samenleving. Waar jaarlijks miljoenen aangiften worden behandeld, en waar voor honderden miljoenen aan toeslagen worden uitbetaald. En waar de Douane dagelijks zorgt voor de vlotte en veilige in- en uitvoer van tonnen goederen. Ondanks deze grote aantallen streven wij waar mogelijk naar individuele en persoonlijke dienstverlening. En in de vorm van bijvoorbeeld convenanten en partnerships werken wij ook zo goed mogelijk samen met het bedrijfsleven en andere ketenpartners. De Belastingdienst: grootschalig, veelzijdig en altijd maatschappelijk relevant.

Commonwealth of Massachusetts

mass.gov

Year after year, the Commonwealth of Massachusetts has continued to pioneer bold legislative actions and programs, some of which have been embraced on a national scale. We are always looking for talented individuals to help us maintain this momentum and improve the services that millions of people depend on every day. If you’re looking for an innovative work environment where you can really make a difference, check out the job opportunities with the Commonwealth of Massachusetts. This page is managed according to the Mass.gov social media policy: https://www.mass.gov/info-details/massgov-social-media-policy. Comments that do not follow our policy may be removed.

Ministry of Health Saudi Arabia

moh.gov.sa

The Ministry of Health (MOH), by way of its objectives, policies and projects included in this strategy, seeks to accomplish a promising future vision; namely, delivering best-quality integrated and comprehensive healthcare services. Carrying health conditions or health status of Saudi inhabitants to the best and highest possible level, in terms of justice and equality in providing healthcare, and in terms of effectiveness and the possibility of incurring the financial burden of the treatment and healthcare. In doing so, the MOH takes as its target meeting citizens’ aspirations in this regard, by providing them with high-quality general and specialized health services, and covering all the population with these services. Creating a sole and exclusive entity to formulate health policies including health insurance services, etc. (such as operating the recently established Health Services Council.) Adopting a public and national health strategy which focuses of the main morbidity burdens; including non-communicable diseases, nutrition, reproductive health, smoking (tobacco-use), AIDS, traffic accidents, and injuries. The system must have an effective and fair method for estimating risks and benefits. Working to diversify sources of revenues to finance the system effectively. These sources must include also public revenues and insurance premiums, in addition to the equally allocated costs and taxes.

State of Illinois

illinois.gov

The government of Illinois, under the Constitution of Illinois, has three branches of government: executive, legislative and judicial. The executive branch is split into several statewide elected offices, with the Governor as chief executive, and has numerous departments, agencies, boards and commissions. Legislative functions are granted to the General Assembly, composed of the 118-member House of Representatives and the 59-member Senate. The judiciary is composed of the Supreme Court and lower courts. The government of Illinois has numerous departments, agencies, boards and commissions, but the code departments, so called because they're established by the Civil Administrative Code of Illinois, provide most of the state's services: Department on Aging Department of Agriculture Department of Central Management Services Department of Children and Family Services Department of Commerce and Economic Opportunity Department of Corrections Department of Employment Security Department of Financial and Professional Regulation Department of Healthcare and Family Services Department of Human Rights Department of Human Services Department of Juvenile Justice Department of Labor Department of the Lottery Department of Natural Resources Department of Public Health Department of Revenue Department of State Police Department of Transportation Department of Veterans' Affairs

Transportation Security Administration (TSA)

tsa.gov

The Transportation Security Administration (TSA) is a component agency of the U.S. Department of Homeland Security (DHS), committed to securing the nation’s transportation systems to ensure safe and efficient travel for all. Our mission is to protect the American people by preventing threats and disruptions in the transportation sector, while enhancing the overall passenger experience. 🔹 Mission: Safeguard transportation systems and prevent security threats 🔹 Vision: Achieve a secure and resilient transportation network 🔹 Values: Integrity, Excellence, Accountability, and Innovation More than 60,000 people around the world make up #TeamTSA and ensure the safety of millions of people each day as they travel by plane, train, automobile or ferry. From the officers you see on the frontlines to our cybersecurity and mission support teams, we’re working hard to combat evolving threats and keep you safe. Join us in our commitment to a more secure travel experience. For more information, visit tsa.gov.

Loading…

NEWS

Department for Culture, Media and Sport CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

February 11, 2026 08:00 AM

Claro earns Fortinet award for education cybersecurity project

Claro Puerto Rico has received Fortinet's 2025 Flagship Project Award for a cybersecurity initiative supporting the Puerto Rico Department...

Read Article

December 05, 2025 08:00 AM

DSIT’s CNI cybersecurity drive harnesses SME smarts to bolster infrastructure resilience

The Department for Science, Innovation and Technology (DSIT) – in partnership with innovation and growth accelerator Plexal – has expanded...

Read Article

December 03, 2025 08:00 AM

Virginia Cyber Range advisory chair testifies before Congress on cybersecurity education

The testimony underscored the strength of Virginia Tech's partnerships with educators, universities, and public-sector initiatives in...

Read Article

October 13, 2025 07:00 AM

Region’s Critical Infrastructure Has Guards at the Gate

SAN DIEGO – Brendan Daly talks about the need for a “human firewall” when it comes to securing the region's critical infrastructure.

Read Article

October 06, 2025 07:00 AM

Cybersecurity in accounting education: accounting academics' perspectives

IntroductionCyberattacks continue to intensify and are currently the top global technological risk. This global increase in cyberattacks and...

Read Article

October 02, 2025 07:00 AM

Georgia Tech settles federal lawsuit after alleged cybersecurity violations

Former and current Georgia Tech whistleblowers claimed 'star quarterback' researchers were able to skirt cybersecurity rules they found...

Read Article

October 01, 2025 07:00 AM

Securing the Future: 5 Cybersecurity Risks in Higher Education

Enhance your institution's cybersecurity awareness and resilience against cyberattacks with targeted strategies designed for higher...

Read Article

September 30, 2025 07:00 AM

Permanent Secretary Urges Early Cybersecurity Education in Schools

Permanent Secretary in the Office of the Prime Minister (OPM), Ambassador Dr. Rocky Meade, has called for the integration of cybersecurity...

Read Article

September 30, 2025 07:00 AM

Ministry of Education's $20,000 inquiry fails to find Budget leak to RNZ

The full report of the independent investigation was withheld, but the summary indicated an extensive hunt for the source of the leak.

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-18556

SUMMARY

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://uptime.n-able.com/

CVE-2026-55735

SUMMARY

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55734

SUMMARY

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55733

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-54894

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…