What is the official website of New York State Office of Victim Services ?

The official website of New York State Office of Victim Services is https://ovs.ny.gov/.

What is New York State Office of Victim Services's cybersecurity risk score?

New York State Office of Victim Services has an AI-generated cybersecurity risk score of 760 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has New York State Office of Victim Services experienced?

According to Rankiteo, New York State Office of Victim Services currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has New York State Office of Victim Services been affected by any supply chain cyber incidents ?

According to Rankiteo, New York State Office of Victim Services has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.

Does New York State Office of Victim Services have SOC 2 Type 1 certification ?

According to Rankiteo, New York State Office of Victim Services is not certified under SOC 2 Type 1.

Does New York State Office of Victim Services have SOC 2 Type 2 certification ?

According to Rankiteo, New York State Office of Victim Services does not hold a SOC 2 Type 2 certification.

Does New York State Office of Victim Services comply with GDPR ?

According to Rankiteo, New York State Office of Victim Services is not listed as GDPR compliant.

Does New York State Office of Victim Services have PCI DSS certification ?

According to Rankiteo, New York State Office of Victim Services does not currently maintain PCI DSS compliance.

Does New York State Office of Victim Services comply with HIPAA ?

According to Rankiteo, New York State Office of Victim Services is not compliant with HIPAA regulations.

Does New York State Office of Victim Services have ISO 27001 certification ?

According to Rankiteo,New York State Office of Victim Services is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does New York State Office of Victim Services operate in ?

New York State Office of Victim Services operates primarily in the Government Administration industry.

How many employees does New York State Office of Victim Services have ?

New York State Office of Victim Services employs approximately 38 people worldwide.

Does New York State Office of Victim Services own any subsidiaries ?

New York State Office of Victim Services presently has no subsidiaries across any sectors.

How many LinkedIn followers does New York State Office of Victim Services have ?

New York State Office of Victim Services's official LinkedIn profile has approximately 339 followers.

Does New York State Office of Victim Services have a Crunchbase profile ?

No, New York State Office of Victim Services does not have a profile on Crunchbase.

Does New York State Office of Victim Services have a LinkedIn profile ?

Yes, New York State Office of Victim Services maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/nysovs.

How many cybersecurity incidents has New York State Office of Victim Services experienced ?

As of August 2, 2026, Rankiteo reports that New York State Office of Victim Services has experienced 3 cybersecurity incidents.

How many peer or competitor companies does New York State Office of Victim Services have ?

New York State Office of Victim Services has an estimated 13,105 peer or competitor companies worldwide.

What types of cybersecurity incidents has New York State Office of Victim Services faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Breach and Cyber Attack.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

NYSOVS

Boost Score +25 with badge (5 left)

760

/1000

Fair

785

/1000

Fair

New York State Office of Victim Services Vendor Cyber Rating & Cyber Score

ny.gov

Add Your Compliance Badge

The New York State Office of Victim Services has a three-tiered mission to provide compensation to innocent victims of crime, fund direct services to crime victims through a network of community-based programs and to advocate for the rights of all innocent victims of crime. For more information about services offered by OVS, including eligibility guidelines and a list of victim assistance programs that provide direct help to crime victims across all 62 counties in New York, visit the agency’s website at ovs.ny.gov or call 1-800-247-8035.

NYSOVS A.I CyberSecurity Scoring

Scoring History

NYSOVS

New York State Office of Victim Services CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

Office of the New Y...

Breach

5/2026

POLOFF178041116...

New York State Offi...

Breach

8/2025

OFF353213511152...

New York State Offi...

Cyber Attack

100

12/2021

NEW141512522

Loading…

A.I.

NYSOVS Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for NYSOVS

Incidents vs Government Administration Industry Avg (This Year)

No incidents recorded for New York State Office of Victim Services in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for New York State Office of Victim Services in 2026.

Incident Types NYSOVS vs Government Administration Industry Avg (This Year)

No incidents recorded for New York State Office of Victim Services in 2026.

Incident History - NYSOVS (X = Date, Y = Severity)

Loading…

SUBSIDIARY

New York State Office of Victim Services Subsidiaries

NYSOVS

Government Administration

Website: https://ovs.ny.gov/

Company Size: 38

New York State Center for Recruitment & Public ServiceGovernment Administration

New York Power AuthorityUtilities

ReCharge NYUtilities

NYSERDAGovernment Administration

New York State Department of HealthPublic Health

Empire State DevelopmentEconomic Programs

NYS MWBEGovernment Administration

New York VenturesVenture Capital and Private Equity Principals

Capital Region Regional Economic Development CouncilEconomic Programs

North Country Regional Economic Development CouncilEconomic Programs

New York State Office of Mental HealthGovernment Administration

Evidence Based Treatment Dissemination Center (EBTDC)Professional Training and Coaching

New York State Department of LaborGovernment Administration

NYS Department of TransportationCivil Engineering

NYS Department of Environmental ConservationEnvironmental Services

New York State Insurance Fund (NYSIF)Insurance

NYS Office for People With Developmental DisabilitiesGovernment Administration

New York State Executive ChamberGovernment Administration

Office of the New York State Attorney GeneralLaw Enforcement

NYS Office of Information Technology ServicesIT Services and IT Consulting

New York State PoliceLaw Enforcement

New York State Department of Financial ServicesFinancial Services

New York State Office of Cannabis ManagementGovernment Administration

New York State Department of Civil ServiceGovernment Administration

New York State Parks, Recreation & Historic PreservationGovernment Administration

NYS Office of General ServicesGovernment Administration

Office of the NYS Comptroller Thomas P. DiNapoliGovernment Administration

NYS Office of Children and Family ServicesGovernment Administration

NYS Division of Homeland Security & Emergency ServicesGovernment Relations Services

New York State Department of StateGovernment Administration

DASNY (Dormitory Authority - State of New York )Construction

New York State Department of Public ServiceGovernment Administration

New York State Homes & Community RenewalGovernment Administration

New York State Division of Criminal Justice ServicesGovernment Administration

NYS Division of Human RightsGovernment Administration

New York State Department of Taxation and FinanceGovernment Administration

New York State Thruway AuthorityCivil Engineering

New York State Council on the Arts (NYSCA)Government Administration

NYS Department of Agriculture and MarketsGovernment Administration

NYS Office of Temporary & Disability AssistanceGovernment Administration

New York State Office of the Medicaid Inspector GeneralGovernment Administration

New York State Justice Center for the Protection of People with Special NeedsGovernment Administration

New York State Inspector GeneralGovernment Administration

New York State Office for the Prevention of Domestic ViolenceGovernment Administration

New York State Department of Motor VehiclesGovernment Administration

New York State Division of the BudgetPublic Policy Offices

Working at DOBPublic Policy Offices

New York State Higher Education Services CorporationFinancial Services

New York State Department of Veterans' ServicesGovernment Administration

New York State Workers' Compensation BoardGovernment Administration

New York State Liquor AuthorityGovernment Administration

NYS Department of Corrections and Community SupervisionPublic Safety

NYS Office of Indigent Legal ServicesLegal Services

Ny State Liquor AuthorityGovernment Administration

Loading…

New York State Office of Victim Services Similar Companies

Transportation Security Administration (TSA)

tsa.gov

The Transportation Security Administration (TSA) is a component agency of the U.S. Department of Homeland Security (DHS), committed to securing the nation’s transportation systems to ensure safe and efficient travel for all. Our mission is to protect the American people by preventing threats and disruptions in the transportation sector, while enhancing the overall passenger experience. 🔹 Mission: Safeguard transportation systems and prevent security threats 🔹 Vision: Achieve a secure and resilient transportation network 🔹 Values: Integrity, Excellence, Accountability, and Innovation More than 60,000 people around the world make up #TeamTSA and ensure the safety of millions of people each day as they travel by plane, train, automobile or ferry. From the officers you see on the frontlines to our cybersecurity and mission support teams, we’re working hard to combat evolving threats and keep you safe. Join us in our commitment to a more secure travel experience. For more information, visit tsa.gov.

Københavns Kommune

kk.dk

Københavns Kommune er Danmarks største arbejdsplads med ca. 45.000 medarbejdere. Vi udvikler hovedstaden og servicerer over 500.000 københavnere. Vores mål er at fastholde og udvikle København som en af verdens bedste byer at bo i – og skabe øget vækst gennem viden, innovation og beskæftigelse. Find dit næste job her eller på www.kk.dk/job På vores karrieresite www.kk.dk/job kan du bl.a. se alle vores ledige stillinger og tilmelde dig vores jobagent. Her kan du også læse om vores medarbejdergoder.

U.S. Census Bureau

census.gov

The Census Bureau serves as the nation’s leading provider of quality data about its people and economy. We have been headquartered in Suitland, Maryland since 1942, and currently employ about 4,285 staff members. We are part of the U.S. Department of Commerce and overseen by the Economics and Statistics Administration (ESA). We honor privacy, protect confidentiality, share our expertise globally, and conduct our work openly. We are guided on this mission by our strong and capable workforce, our readiness to innovate, and our abiding commitment to our customers. View our comment policy: https://www.census.gov/about/contact-us/comment-policy.html View our privacy policy: https://www.census.gov/about/policies/privacy/privacy-policy.html

Etat de Vaud

vd.ch

Le canton de Vaud, c’est plus de 800 000 personnes vivant dans plus de 300 communes ! Rejoindre l’Administration cantonale vaudoise, c’est s’engager aux côtés de près de 40’000 personnes unies dans un même but : servir la population. Pourquoi nous suivre ? Dédiez votre quart d’heure vaudois aux opportunités de carrière et à l’info du canton ! Retrouvez les actualités vaudoises, les décisions du Grand Conseil et du Conseil d’Etat qui orientent les politiques publiques, les infos pratiques et les chiffres clés. Découvrez aussi des portraits des collaboratrices et collaborateurs au cœur de l’action et des offres d’emploi variées. Pourquoi nous rejoindre ? Nous rejoindre, c’est s’engager auprès d’un employeur fiable, éthique, équitable et tourné vers la durabilité. Parce que les envies, les attentes et les besoins évoluent tout au long d’une carrière, nous proposons des formations, des opportunités de développement de carrière ainsi qu’un équilibre entre vie privée et vie professionnelle. Vous aussi contribuez à l’actualité et à l’avenir du canton ! Retrouvez toutes nos offres d’emploi sur www.vd.ch/offres-demploi

City of Los Angeles

linkpages.pro

The City of Los Angeles employs more than 45,000 people in a wide range of careers. Visit our website for information on current openings, including regular civil service positions, exempt and emergency appointment opportunities, in addition to internships! The City of Los Angeles is a Mayor-Council-Commission form of government, as originally adopted by voters of the City of Los Angeles, effective July 1, 1925, and reaffirmed by a new Charter effective July 1, 2000. A Mayor, City Controller, and City Attorney are elected by City residents every four years. Fifteen City Council members representing fifteen districts are elected by the people for four-year terms, for a maximum of two terms. Members of Commissions are generally appointed by the Mayor, subject to the approval of the City Council. General Managers of the various City departments are also appointed by the Mayor, subject to confirmation by the City Council. Most employees of the City are subject to the civil service provisions of the City Charter.

U.S. Department of Homeland Security

dhs.gov

The Department of Homeland Security (DHS) has a vital mission: to secure the nation from the many threats we face. This requires the hard work of more than 260,000 employees in jobs that range from aviation and border security to emergency response, from cybersecurity analyst to chemical facility inspector. Our duties are wide-ranging, and our goal is clear - keeping America safe. Mission 1: Counter Terrorism and Homeland Security Threats Mission 2: Secure U.S. Borders and Approaches Mission 3: Secure Cyberspace and Critical Infrastructure Mission 4: Preserve and Uphold the Nation's Prosperity and Economic Security Mission 5: Strengthen Preparedness and Resilience Mission 6: Champion the DHS Workforce and Strengthen the Department We continually strengthen our partnerships with communities, first responders, law enforcement and government agencies - at the state, local, tribal, federal and international levels. We are accelerating the deployment of science, technology, and innovation in order to make America more secure. And we are becoming leaner, smarter, and more efficient, ensuring that every security resource is used as effectively as possible. Together, we are committed to relentless resilience, striving to prevent future attacks against the United States and our allies, responding decisively to natural and man-made disasters, and advancing American prosperity and economic security long into the future.

European Commission

europa.eu

The Commission represents and upholds the interests of the EU as a whole, and is independent of national governments. The European Commission prepares legislation for adoption by the Council (representing the member countries) and the Parliament (representing the citizens). It administers the budget and the policy programmes (agriculture, fisheries, research etc.) in cooperation with authorities in the member countries. Visit http://www.europa.eu/ if you want to learn more about the EU, or call the free service number 00 800 6789 10 11 from anywhere in the EU, they speak all 24 official languages. Disclaimer: The European Commission is working to ensure that social networks respect the highest standards of data protection. All users of social networks should be particularly careful about how they disclose their personal information and about how it may be used by third parties and the social network themselves. The presence of the European Commission on LinkedIn does not mean that we endorse or in any way agree with the privacy policy or practices of this professional social media network. Read more about our social media policy → europa.eu/!dyJq74

IBGE

ibge.gov.br

The Brazilian Institute of Geography and Statistics or IBGE (Portuguese: Instituto Brasileiro de Geografia e Estatística), is the agency responsible for statistical, geographic, cartographic, geodetic and environmental information in Brazil. The IBGE performs a national census every ten years, and the questionnaires account for information such as age, household income, literacy, education, occupation and hygiene levels. IBGE is an institution of the Federal Government, constituted a public foundation by Decree Law No. 161 of February 13, 1967, and is bound to the Brazilian Department of Planning, Budget and Management. It has four directors and two other central organs. IBGE has a network of national research and dissemination components, comprising: 27 state units (26 in state capitals and one in the Federal District); 27 centres for documentation and dissemination of information (26 in the capital and one in the Federal District); 581 data collection agencies in major cities. The IBGE also maintains the Roncador Ecological Reserve, situated 35 km south of Brasília.

Malmö stad

malmo.se

Bli en samhällsbyggare – jobba i Malmö stad! Genom att arbeta i Malmö stad får du möjlighet att arbeta med hållbar samhällsutveckling. Som en samhällsbyggare spelar du en viktig roll i Malmös utveckling och därför ser vi oss som framtidens arbetsplats. Människors lika värde är en förutsättning för demokrati och är också en självklarhet i vår värdegrund. Med 20 000 medarbetare är Malmö stad en av de största arbetsgivarna i Skåne. Vi har över 400 yrkeskategorier representerade inom 22 förvaltningar. Är du intresserad av att jobba hos oss? Se våra lediga tjänster på http://www.malmo.se/jobb

Loading…

NEWS

New York State Office of Victim Services CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

December 04, 2025 08:00 AM

Tracking how the Trump administration is making the criminal legal system worse

The American criminal legal system has always been terrible, but what has happened in recent months is different. It is in a new kind of...

Read Article

November 28, 2025 09:41 PM

Partnership Briefing to appeal for support for UN victims of terrorism Programme

The Global Programme on Victims of Terrorism of the United Nations Office of Counter-Terrorism (UNOCT) held a Partnership Briefing for representatives of...

Read Article

November 27, 2025 08:34 PM

Launch of the Victims of Terrorism Associations Network (VoTAN)

WhatLaunch of the Victims of Terrorism Associations Network, known as VoTAN, by the United Nations Office of Counter-Terrorism (UNOCT). The network is a key...

Read Article

November 27, 2025 11:55 AM

UN International Conference on Victims of Terrorism - 2024

The Global Victims of Terrorism Support ProgrammeThe UNOCT/UNCCT Global Victims of Terrorism Support Programme aims to promote solidarity, raise awareness,...

Read Article

November 17, 2025 08:00 AM

Nebraska AG’s Lawsuit Against Change Healthcare Survives Motion to Dismiss

A lawsuit filed by Nebraska Attorney General Mike Hilgers over the 2024 Change Healthcare data breach has been allowed to proceed after...

Read Article

October 26, 2025 07:00 AM

Healthcare Data Breach Statistics

The HIPAA Journal has compiled healthcare data breach statistics from October 2009, when the Department of Health and Human Services (HHS)...

Read Article

October 01, 2025 07:00 AM

States sue over US Justice Department's new restrictions on grants for domestic violence victims

A group of Democratic-led states filed a lawsuit on Wednesday challenging new U.S. restrictions barring them from using federal grant...

Read Article

October 01, 2025 07:00 AM

States Say DOJ Can't Tie Victim Service Funds To Immigration

Several state attorneys general sued the U.S. Department of Justice in Rhode Island federal court Wednesday over new restrictions...

Read Article

August 01, 2025 07:00 AM

HSI combats child exploitation at home and abroad

Protecting the public from crimes of victimization and strategically targeting and investigating individuals and networks that engage in...

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-18556

SUMMARY

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://uptime.n-able.com/

CVE-2026-55735

SUMMARY

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55734

SUMMARY

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55733

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-54894

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…