What is the official website of Ofqual ?

The official website of Ofqual is https://www.gov.uk/ofqual.

What is Ofqual's cybersecurity risk score?

Ofqual has an AI-generated cybersecurity risk score of 763 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has Ofqual experienced?

According to Rankiteo, Ofqual currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has Ofqual been affected by any supply chain cyber incidents ?

According to Rankiteo, Ofqual has been affected by a supply chain cyber incident involving Fortinet, with the incident ID FORGOV1783297461.

Does Ofqual have SOC 2 Type 1 certification ?

According to Rankiteo, Ofqual is not certified under SOC 2 Type 1.

Does Ofqual have SOC 2 Type 2 certification ?

According to Rankiteo, Ofqual does not hold a SOC 2 Type 2 certification.

Does Ofqual comply with GDPR ?

According to Rankiteo, Ofqual is not listed as GDPR compliant.

Does Ofqual have PCI DSS certification ?

According to Rankiteo, Ofqual does not currently maintain PCI DSS compliance.

Does Ofqual comply with HIPAA ?

According to Rankiteo, Ofqual is not compliant with HIPAA regulations.

Does Ofqual have ISO 27001 certification ?

According to Rankiteo,Ofqual is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does Ofqual operate in ?

Ofqual operates primarily in the Government Administration industry.

How many employees does Ofqual have ?

Ofqual employs approximately 424 people worldwide.

Does Ofqual own any subsidiaries ?

Ofqual presently has no subsidiaries across any sectors.

How many LinkedIn followers does Ofqual have ?

Ofqual's official LinkedIn profile has approximately 34,517 followers.

What is the NAICS classification code for Ofqual ?

Ofqual is classified under the NAICS code 92, which corresponds to Public Administration.

Does Ofqual have a Crunchbase profile ?

No, Ofqual does not have a profile on Crunchbase.

Does Ofqual have a LinkedIn profile ?

Yes, Ofqual maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/ofqual.

How many cybersecurity incidents has Ofqual experienced ?

As of August 2, 2026, Rankiteo reports that Ofqual has experienced 26 cybersecurity incidents.

How many peer or competitor companies does Ofqual have ?

Ofqual has an estimated 13,106 peer or competitor companies worldwide.

What types of cybersecurity incidents has Ofqual faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability, Breach, Ransomware and Cyber Attack.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

Ofqual

Boost Score +25 with badge (5 left)

763

/1000

Fair

788

/1000

Fair

Ofqual Vendor Cyber Rating & Cyber Score

www.gov.uk

Add Your Compliance Badge

The regulator of qualifications, exams and assessments in England. We maintain standards and confidence in GCSE, A level, As level, vocational and technical qualifications and Apprenticeship End-Point assessments.

Ofqual A.I CyberSecurity Scoring

Scoring History

Ofqual

Ofqual CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

UK Ministry of Defe...

Breach

100

7/2026

UK-1785371161

Foreign and Commonw...

Cyber Attack

100

7/2026

Fortinet

FORGOV178329746...

Cabinet Office

Breach

5/2026

CAB1777832879

Ofqual

Vulnerability

12/2025

DCM1765433387

Ofqual

Breach

11/2025

UK-523475211042...

Ofqual

Cyber Attack

100

10/2025

UK-556215510202...

Foreign and Commonw...

Breach

10/2025

FOR1766412101

Ofqual

Ransomware

100

9/2025

DCM1764770468

Ofqual

Breach

100

8/2025

UK-841081625

Ofqual

Breach

6/2025

HMR745060625

UK Home Office

Breach

4/2025

UK-1777581082

Ofqual

Breach

100

7/2024

UK-421016421104...

Ofqual

Breach

100

6/2024

UK-169221610212...

Ofqual

Breach

100

4/2024

UK-493314910132...

Ofqual

Breach

100

8/2023

UK-707072025

Ofqual

Breach

100

7/2023

UK-221002221104...

Ofqual

Cyber Attack

100

01/2023

DEP225811123

Ofqual

Breach

100

6/2022

UK-289342811142...

Ofqual

Breach

100

2/2022

UK-503305010202...

Ofqual

Breach

1/2022

UK-559215509112...

Ofqual

Breach

11/2021

GOV1527121122

Ofqual

Breach

100

10/2021

UK-576295710232...

HM Revenue & Custom...

Cyber Attack

9/2021

HMR1782752907

Ofqual

Breach

100

8/2021

UK-552175511242...

Ofqual

Breach

100

6/2021

UK-089380810032...

Ofqual

Breach

100

6/2010

UK-069420609202...

Loading…

A.I.

Ofqual Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for Ofqual

Incidents vs Government Administration Industry Avg (This Year)

No incidents recorded for Ofqual in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for Ofqual in 2026.

Incident Types Ofqual vs Government Administration Industry Avg (This Year)

No incidents recorded for Ofqual in 2026.

Incident History - Ofqual (X = Date, Y = Severity)

Loading…

SUBSIDIARY

Ofqual Subsidiaries

Ofqual

Government Administration

Website: https://www.gov.uk/ofqual

Company Size: 424

UK Civil ServiceGovernment Administration

Department for EducationGovernment Administration

TeachingPrimary and Secondary Education

Buying for SchoolsGovernment Administration

DfE Digital, Data and TechnologyGovernment Relations Services

Skills PartnerGovernment Administration

UK Ministry of DefenceDefense and Space Manufacturing

Defence ProcurementDefense & Space

Foreign and Commonwealth OfficeGovernment Administration

Department of Health and Social CareGovernment Relations Services

DstlDefense and Space Manufacturing

Data Science ChallengeGovernment Administration

UK Export FinanceFinancial Services

Charity Commission for England and WalesGovernment Administration

Office of Rail and Road (ORR)Truck Transportation

Competition and Markets AuthorityGovernment Administration

OfwatUtilities

Regulators’ Alliance for Progressing Infrastructure Development (RAPID)Utilities

UK Home OfficeGovernment Administration

HM Revenue & CustomsGovernment Administration

National Infrastructure and Service Transformation Authority (NISTA)Government Administration

HM Land RegistryGovernment Administration

Scotland OfficeGovernment Administration

Attorney General's Office (UK)Government Administration

Valuation Office AgencyGovernment Administration

Northern Ireland OfficeGovernment Administration

NS&IFinancial Services

Government Actuary's DepartmentGovernment Administration

OfstedGovernment Administration

Cabinet OfficeGovernment Administration

HM Government Public AppointmentsGovernment Administration

GOV.UKGovernment Relations Services

UK Statistics Authority Government Administration

Department for Transport (DfT), United KingdomGovernment Administration

Department for Environment, Food and Rural AffairsGovernment Administration

Defra Public AppointmentsGovernment Administration

Defra digital, data, technology and securityIT Services and IT Consulting

Food Standards AgencyGovernment Administration

Starting a Food BusinessFood & Beverages

Department for Business and TradeGovernment Administration

GREAT Trade and InvestmentWholesale Import and Export

Business SupportGovernment Relations

UK Business and Trade - North AmericaGovernment Relations Services

Forestry CommissionGovernment Administration

OfgemUtilities

Crown Prosecution ServiceLaw Practice

Department for Culture, Media and SportGovernment Administration

DCMS Public AppointmentsGovernment Administration

HM TreasuryPublic Policy Offices

Office of Financial Sanctions Implementation (OFSI)Government Administration

Department for Work and Pensions (DWP)Government Administration

Disability ConfidentGovernment Administration

See PotentialGovernment Administration

Department for Science, Innovation and TechnologyGovernment Administration

Careers at the Department for Science, Innovation and TechnologyGovernment Administration

Department for International Development (DFID)Government Administration

UK-Africa Investment Summit 2020Government Administration

Government Legal DepartmentLegal Services

Office for National StatisticsGovernment Administration

Census2021Government Administration

Government Statistical ServiceGovernment Administration

Wales Office/Swyddfa CymruGovernment Administration

Loading…

Ofqual Similar Companies

Workingfor.be

workingfor.be

Workingfor.be is the job platform of the federal administration. Here, you will find a wide variety of jobs in different fields of profession. Every day thousands of our employees help build tomorrow's society. When you choose the federal administration, you choose an employer who embraces your talent and individuality and gives you the opportunity to develop yourself and your skills further every single day. Moreover, we offer you a job where you can easily find the balance between your professional and personal life. Do you want to contribute to the Belgium of tomorrow? Feel like making a difference and developing your talents? Discover our wide range of vacancies at www.workingfor.be

ISSSTE

www.com

INSTITUTO DE SEGURIDAD Y SERVICIOS SOCIALES DE LOS TRABAJADORES DEL ESTADO. ES UN ORGANISMOS PÚBLICO QUE OTORGA SERVICIOS DE SALUD, PENSIONES, VIVIENDA, PRÉSTAMOS, ESTANCIAS INFANTILES, TURISMO, CULTURA, RECREACION, DEPORTE; CUYOS AFILIADOS SON TRABAJADORES DE DEPENDENCIAS GUBERNAMENTALES, CON DERECHO A LA SEGURIDAD SOCIAL. Y CUYOS OBJETIVOS INSTITUCIONALES ADEMÁS DE CONTRIBUIR A LOGRAR LOS OBJETIVOS PROPUESTOS POR EL PLAN NACIONAL DE DESARROLLO 2007 – 2012, COADYUVARÁN A LOGRAR LA VISIÓN DE LA INSTITUCIÓN ESTABLECIDA PARA EL AÑO 2030 Y CONCRETAR LA MISIÓN QUE TIENE ESTABLECIDA. MISIÓN DEL ISSSTE CONTRIBUIR A SATISFACER NIVELES DE BIENESTAR INTEGRAL DE LOS TRABAJADORES AL SERVICIO DEL ESTADO, PENSIONADOS, JUBILADOS Y FAMILIARES DERECHOHABIENTES, CON EL OTORGAMIENTO EFICAZ Y EFICIENTE DE LOS SEGUROS, PRESTACIONES Y SERVICIOS, CON ATENCIÓN ESMERADA, RESPETO, CALIDAD Y CUMPLIENDO SIEMPRE CON LOS VALORES INSTITUCIONALES DE HONESTIDAD, LEGALIDAD Y TRANSPARENCIA. VISIÓN DEL ISSSTE POSICIONAR AL ISSSTE COMO LA INSTITUCIÓN QUE GARANTICE LA PROTECCIÓN INTEGRAL DE LOS TRABAJADORES DE LA ADMINISTRACIÓN PÚBLICA FEDERAL, PENSIONADOS, JUBILADOS Y SUS FAMILIAS DE ACUERDO AL NUEVO PERFIL DEMOGRÁFICO DE LA DERECHOHABIENCIA, CON EL OTORGAMIENTO DE SEGUROS, PRESTACIONES Y SERVICIOS DE CONFORMIDAD CON LA NORMATIVIDAD VIGENTE, BAJO CÓDIGOS NORMADOS DE CALIDAD Y CALIDEZ, CON SOLVENCIA FINANCIERA, QUE PERMITAN GENERAR VALORES Y PRÁCTICAS QUE FOMENTEN LA MEJORA SOSTENIDA DE BIENESTAR, CALIDAD DE VIDA Y EL DESARROLLO DEL CAPITAL HUMANO. PARA CONOCER MAS DE NUESTRO INSTITUTO FAVOR DE CONSULTAR LA PAGINA INSTITUCIONAL WWW2.ISSSTE.GOB.MX EN DONDE SEGURAMENTE ENCONTRARAN MATERIAL DE ORIENTACION AMENO Y EXPLICATIVO ADEMAS DE LA HISTORIA DE INSTITUTO, SUS ALCANCES Y LOGROS ASI COMO LOS PROGRAMAS CON QUE CUENTA ACTUALMENTE EL INSTITUTO.

City of Toronto

toronto.ca

The City of Toronto is committed to fostering a positive and progressive workplace culture, and strives to build a workforce that reflects the citizens it serves. We are committed to building a high performing public service, with strong and effective leaders to enable service excellence, through high engagement and healthy and safe workplaces. Toronto is home to more than 2.9 million people whose diversity and experiences make this great city Canada’s leading economic engine and one of the world’s most diverse and livable cities. As the fourth largest city in North America, Toronto is a global leader in technology, finance, film, music, culture, and innovation, and consistently places at the top of international rankings due to investments championed by its government, residents and businesses. Toronto Public Service consists of approximately 35,771 employees, providing programs and services to Toronto residents, businesses and visitors. Additionally, the City of Toronto has a number of agencies and corporations including the Toronto Police Service, Toronto Public Library and the Toronto Transit Commission, which make up the broader municipal organization. There are 44 operating divisions and offices providing an extensive level of programs and services. We offer diverse career opportunities across a wide variety of professional, trade, administrative, managerial and other employment roles. The Toronto Public Service has won numerous awards for quality, innovation and efficiency in delivering citizen-focused services. We are proud to have been named one of Canada's Top 100 Employers, Canada's Best Diversity Employers, Top Family Friendly Employers and Greater Toronto's Top Employers. Consider joining the award-winning Toronto Public Service and help us make a difference in a great City!

France Travail

francetravail.fr

France Travail est un acteur majeur du marché de l’emploi en France où il s’investit pour faciliter le retour à l’emploi des demandeurs d’emploi et offrir aux entreprises des réponses adaptées à leurs besoins de recrutement. Les 55 000 collaborateurs de France Travail œuvrent au quotidien pour être le trait d’union entre les demandeurs d’emploi et les entreprises. France Travail is a key player in the French employment market. Its role is to help the unemployed find work and support companies to fulfil their recruitment requirements. Day-to-day, France Travail's 55,000 staff provides that vital link between job seekers and companies.

Københavns Kommune

kk.dk

Københavns Kommune er Danmarks største arbejdsplads med ca. 45.000 medarbejdere. Vi udvikler hovedstaden og servicerer over 500.000 københavnere. Vores mål er at fastholde og udvikle København som en af verdens bedste byer at bo i – og skabe øget vækst gennem viden, innovation og beskæftigelse. Find dit næste job her eller på www.kk.dk/job På vores karrieresite www.kk.dk/job kan du bl.a. se alle vores ledige stillinger og tilmelde dig vores jobagent. Her kan du også læse om vores medarbejdergoder.

Rijkswaterstaat

rijkswaterstaat.nl

Rijkswaterstaat is de uitvoeringsorganisatie van het Ministerie van Infrastructuur en Waterstaat. We beheren en ontwikkelen de rijkswegen, -vaarwegen en –wateren en zetten in op een duurzame leefomgeving. Samen met andere organisaties werken we aan een land dat beschermd is tegen overstromingen. Waar voldoende groen is, en voldoende en schoon water. En waar je vlot en veilig van A naar B kunt. Samenwerken aan een veilig, leefbaar en bereikbaar Nederland. Dat is Rijkswaterstaat. Bij Rijkswaterstaat werk je mee aan de toekomst van Nederland met de ruimte om jezelf te blijven ontwikkelen. Gun jezelf een baan met toekomst. Gun jezelf Rijkswaterstaat.

Ministry of Health Saudi Arabia

moh.gov.sa

The Ministry of Health (MOH), by way of its objectives, policies and projects included in this strategy, seeks to accomplish a promising future vision; namely, delivering best-quality integrated and comprehensive healthcare services. Carrying health conditions or health status of Saudi inhabitants to the best and highest possible level, in terms of justice and equality in providing healthcare, and in terms of effectiveness and the possibility of incurring the financial burden of the treatment and healthcare. In doing so, the MOH takes as its target meeting citizens’ aspirations in this regard, by providing them with high-quality general and specialized health services, and covering all the population with these services. Creating a sole and exclusive entity to formulate health policies including health insurance services, etc. (such as operating the recently established Health Services Council.) Adopting a public and national health strategy which focuses of the main morbidity burdens; including non-communicable diseases, nutrition, reproductive health, smoking (tobacco-use), AIDS, traffic accidents, and injuries. The system must have an effective and fair method for estimating risks and benefits. Working to diversify sources of revenues to finance the system effectively. These sources must include also public revenues and insurance premiums, in addition to the equally allocated costs and taxes.

Department of Health (Philippines)

doh.gov.ph

The Philippine Department of Health (abbreviated as DOH; Filipino: Kagawaran ng Kalusugan) is the executive department of the Philippine government responsible for ensuring access to basic public health services by all Filipinos through the provision of quality health care and the regulation of all health services and products. It is the government's over-all technical authority on health. It has its headquarters at the San Lazaro Compound, along Rizal Avenue in Manila. The department is led by the Secretary of Health, nominated by the President of the Philippines and confirmed by the Commission on Appointments. The Secretary is a member of the Cabinet. The current Secretary of Health is Francisco Duque.

Texas Health and Human Services

texas.gov

Overview The Texas Health and Human Services Commission (HHSC) is an agency within the Texas Health and Human Services System. In September 2016, Texas began transforming how it delivers health and human services to qualified Texans, with a goal of making the Health and Human Services System more efficient and effective. Sept. 1, 2017, marked another major milestone in this transformation. The new accountable, restructured system: - Makes it easier for people to find out about the services or benefits for which they may qualify. - Better integrates programs by removing bureaucratic silos and grouping similar programs and services together. - Creates clear lines of accountability within the organization. - Includes well-defined and objective performance metrics for all organizational areas. Texas Health and Human Services now consists of 2 agencies: the Texas Health and Human Services Commission and the Texas Department of State Health Services (DSHS). HHS is headquartered in Austin, TX. Services Provided - Medicaid for families and children - Long-term care for people who are older or have disabilities - SNAP (Supplemental Nutrition Assistance Program) food benefits and TANF (Temporary Assistance For Needy Families) cash assistance for families Behavior health services - Services to help keep people who are older or who have disabilities in their homes or communities - Services for women or other people with special health needs Oversight of Regulatory Functions - Licensing and credentialing of long-term care facilities, such as nursing homes and assisted living - Licensing child care providers - Managing the day-to-day operations of state supported living centers and state hospitals

Loading…

NEWS

Ofqual CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

December 17, 2025 08:00 AM

England to keep pen and paper exams, says watchdog Ofqual

Most students taking school and college GCSE, A-level, and AS-level exams in England will continue to use pen and paper, according to...

Read Article

December 16, 2025 08:00 AM

NEWS: Ofqual Plans Shift to Onscreen GCSEs and A-levels by 2030

As reported by the Guardian, qualifications watchdog Ofqual launches consultation amid complaints from pupils about writing fatigue in exams.

Read Article

December 16, 2025 08:00 AM

Ofqual considers introducing onscreen GCSEs and A-levels by 2030 due to student feedback on writing fatigue

Students in England may find themselves taking their GCSEs and A-levels on laptops by the end of the decade, as the qualifications regulator...

Read Article

December 11, 2025 08:00 AM

Some GCSEs and A-levels in England could be taken on laptops by 2030, Ofqual says

Qualifications watchdog launches consultation amid complaints from pupils about writing fatigue in exams.

Read Article

December 11, 2025 08:00 AM

Ofqual delivery report 2025

The scale of qualifications covered by this report is significant, with over 7.5 million results awarded to students and apprentices.

Read Article

December 04, 2025 08:00 AM

‘Good progress’ towards NCFE recovery after cyber incident

NCFE said it is making 'good progress' restoring its systems and plans to begin resuming apprenticeship assessments after a 'cyber incident'...

Read Article

December 02, 2025 08:00 AM

NCFE shuts down systems after ‘cyber incident’

A “cyber security incident” has forced a major national awarding organisation to shut down its IT systems, triggering widespread...

Read Article

October 01, 2025 07:00 AM

Cyber training in schools improves, but recovery times slow, research finds

New data from Ofqual has revealed that schools and colleges across England are making progress in cybersecurity training but are struggling...

Read Article

October 01, 2025 07:00 AM

Schools are swotting up on security yet still flunk recovery when cyberattacks strike

Schools and colleges hit by cyberattacks are taking longer to restore their networks — and the consequences are severe, with students'...

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-18556

SUMMARY

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://uptime.n-able.com/

CVE-2026-55735

SUMMARY

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55734

SUMMARY

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55733

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-54894

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…