What is the official website of RCG | Risk Consulting Group ?

The official website of RCG | Risk Consulting Group is http://www.rcgherco.com.

What is RCG | Risk Consulting Group's cybersecurity risk score?

RCG | Risk Consulting Group has an AI-generated cybersecurity risk score of 750 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has RCG | Risk Consulting Group experienced?

According to Rankiteo, RCG | Risk Consulting Group currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has RCG | Risk Consulting Group been affected by any supply chain cyber incidents ?

According to Rankiteo, RCG | Risk Consulting Group has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.

Does RCG | Risk Consulting Group have SOC 2 Type 1 certification ?

According to Rankiteo, RCG | Risk Consulting Group is not certified under SOC 2 Type 1.

Does RCG | Risk Consulting Group have SOC 2 Type 2 certification ?

According to Rankiteo, RCG | Risk Consulting Group does not hold a SOC 2 Type 2 certification.

Does RCG | Risk Consulting Group comply with GDPR ?

According to Rankiteo, RCG | Risk Consulting Group is not listed as GDPR compliant.

Does RCG | Risk Consulting Group have PCI DSS certification ?

According to Rankiteo, RCG | Risk Consulting Group does not currently maintain PCI DSS compliance.

Does RCG | Risk Consulting Group comply with HIPAA ?

According to Rankiteo, RCG | Risk Consulting Group is not compliant with HIPAA regulations.

Does RCG | Risk Consulting Group have ISO 27001 certification ?

According to Rankiteo,RCG | Risk Consulting Group is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does RCG | Risk Consulting Group operate in ?

RCG | Risk Consulting Group operates primarily in the Business Consulting and Services industry.

How many employees does RCG | Risk Consulting Group have ?

RCG | Risk Consulting Group employs approximately 28 people worldwide.

Does RCG | Risk Consulting Group own any subsidiaries ?

RCG | Risk Consulting Group presently has no subsidiaries across any sectors.

How many LinkedIn followers does RCG | Risk Consulting Group have ?

RCG | Risk Consulting Group's official LinkedIn profile has approximately 879 followers.

What is the NAICS classification code for RCG | Risk Consulting Group ?

RCG | Risk Consulting Group is classified under the NAICS code 5416, which corresponds to Management, Scientific, and Technical Consulting Services.

Does RCG | Risk Consulting Group have a Crunchbase profile ?

No, RCG | Risk Consulting Group does not have a profile on Crunchbase.

Does RCG | Risk Consulting Group have a LinkedIn profile ?

Yes, RCG | Risk Consulting Group maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/rcgherco.

How many cybersecurity incidents has RCG | Risk Consulting Group experienced ?

As of September 9, 2026, Rankiteo reports that RCG | Risk Consulting Group has not experienced any cybersecurity incidents.

How many peer or competitor companies does RCG | Risk Consulting Group have ?

RCG | Risk Consulting Group has an estimated 19,811 peer or competitor companies worldwide.

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

RRCG

Boost Score +25 with badge (5 left)

750

/1000

Fair

775

/1000

Fair

RCG | Risk Consulting Group Vendor Cyber Rating & Cyber Score

rcgherco.com

Add Your Compliance Badge

Com 50 anos de experiência, a RCG| Powered by Herco é hoje conhecida como modelo de excelência na análise de risco, controle de perdas e implantação de programas de gestão de riscos. A empresa fornece serviços em nível mundial para diversos segmentos da indústria com equipe técnica multidisciplinar composta por engenheiros químicos, mecânicos, eletricistas, técnicos de segurança no trabalho e especialistas em logística e transportes.

RRCG

RCG | Risk Consulting Group CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

No data available

Loading…

A.I.

RRCG Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for RRCG

Incidents vs Business Consulting and Services Industry Avg (This Year)

No incidents recorded for RCG | Risk Consulting Group in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for RCG | Risk Consulting Group in 2026.

Incident Types RRCG vs Business Consulting and Services Industry Avg (This Year)

No incidents recorded for RCG | Risk Consulting Group in 2026.

Incident History - RRCG (X = Date, Y = Severity)

Loading…

SUBSIDIARY

RCG | Risk Consulting Group Subsidiaries

RRCG

Business Consulting and Services

Website: http://www.rcgherco.com

Company Size: 28

Ardonagh Global PartnersInsurance

MDS GroupInsurance

EnvestFinancial Services

Aviso BrokingInsurance Agencies and Brokerages

Klap verzekeringsmakelaarInsurance

EvenementenverzekeringInsurance

Ardonagh EuropeInsurance

BeroepsaansprakelijkheidsverzekeringenInsurance

CyberverzekeringInsurance

KredietverzekeringInsurance

Corretora Brokers de SegurosInsurance

Accive Insurance - Corretor de SegurosInsurance

Club 4X4 InsuranceInsurance

Wellington Underwriting AgenciesInsurance

Renaissance Insurance Brokers LtdInsurance

Acumen InsuranceInsurance

ATL Insurance GroupInsurance

CredRisk MarineInsurance

Unificado Corretora de SegurosInsurance

NQIB - North Queensland Insurance BrokersInsurance

Special Risk Solutions (SRS) Group of CompaniesInsurance

LéonsInsurance

Grange Insurance SolutionsInsurance

HWF PartnersInsurance

ResiliumInsurance

Epsilon UnderwritingInsurance

IberosegurInsurance

MDS AfricaInsurance

Loading…

RCG | Risk Consulting Group Similar Companies

Ayesa

ayesa.com

Ayesa is a global provider of technology and engineering services with more than 11500 employees in twenty-three countries across Europe, Latin America, Africa and Asia. The company develops and implements digital solutions for the private and public sector and uses the latest technology to provide cutting-edge infrastructure design and supervision services. To do this, it has certified experts covering more than 70 different disciplines in utilities and energy; the public sector; banking and insurance; water and the environment, transportation; aeronautics and defence; and construction. As a company that is driven by people and innovation, its business approach is underpinned by talent.

PwC Deutschland

pwc.de

PwC is the leading auditing and consulting company in Germany. As an independent member of the international PwC network, it offers its services worldwide. PwC audits and advises leading industrial and service companies of all sizes. In Germany, over 15,000 employees generate revenues of more than three billion euros in the divisions of audit and audit-related services (assurance solutions), tax and legal advice (tax & legal solutions), transformation, risk & regulatory, sustainability, cloud & digital, and deals. The experts in the different service lines work together across all divisions and from different offices in Germany, making it possible to meet with them individually at 20 locations nationwide. Also part of PwC is Strategy& – a global team of practice-oriented strategists. You can find more information about our team of strategy advisors here: https://www.strategyand.pwc.com/ Thanks to its worldwide network, PwC is able to provide its clients with professional services around the world and to offer cross-border support. As an independent member of this network, PwC Germany has access to more than 365,000 employees in 136 countries. You can find current vacancies at PwC Germany and information on PwC’s different divisions on our career page: www.karriere.pwc.de If you have any questions about vacancies at the German firm or the application process, a member of our staff will be happy to help. Simply give us a call at +49 69 9585 - 5226 or send us an e-mail to: [email protected] For more insights into the world of PwC Germany, you can follow us on the following channels: Xing PwC Germany: www.xing.com/company/pwcdeutschland X PwC Germany: @pwc_de Instagram PwC Germany: www.instagram.com/pwc_de YouTube PwC Germany: www.youtube.com/user/pwcde YouTube PwC Career: www.youtube.com/user/pwccareerde Imprint: https://www.pwc.de/impressum

DKSH

dksh.com

About DKSH DKSH’s purpose is to enrich people’s lives. For 160 years, we have been marketing, selling, and distributing high-quality products and brands for multinational and Fortune 500 companies. Through our Business Units Consumer Goods, Healthcare, Performance Materials, and Technology, we deliver sustainable growth for our partners. We contribute to improving the quality of life for our employees and people in the local communities in which we operate. Headquartered in Switzerland, DKSH is publicly listed and operates in 36 markets across Asia Pacific, Europe, and North America. We employ over 28,000 specialists and produced net sales of CHF 11.1 billion in 2024. Why it's great to work with us At DKSH, we are driven by a purpose that goes beyond the ordinary: enriching people's lives. Through the products and services we provide, DKSH positively impacts millions of lives everyday. Join our team where entrepreneurship meets flexible work arrangements. Take the leap and start a journey where you can grow and make a difference! Learn more about working at DKSH: https://bit.ly/dksh-careers View jobs now: https://bit.ly/dksh-jobs *We do not send job offers from free email services (Gmail, Yahoo mail, Hotmail, etc.), request money from candidates, or require personal documents like bank account details, tax forms, or credit card information from candidates before they are hired: https://bit.ly/dksh-recruitment-disclaimer.

EY-Parthenon

ey.com

Our unique combination of transformative strategy, transactions and corporate finance delivers real-world value – solutions that work in practice, not just on paper. Benefiting from EY’s full spectrum of services, we’ve reimagined strategic consulting to work in a world of increasing complexity. With deep functional and sector expertise, paired with innovative AI-powered technology and an investor mindset, we partner with CEOs, boards, private equity and governments every step of the way – enabling you to shape your future with confidence. EY-Parthenon is a brand under which a number of EY member firms across the globe provide strategy consulting services. For more information, please visit ey.com/parthenon.

BearingPoint

bearingpoint.com

BearingPoint is an independent management and technology consultancy. Our roots are European, but our footprint is truly global. Transformation is our core service. We deliver value to enterprises, government organizations and NGOs. In a rapidly changing world, BearingPoint provides solutions to tomorrow’s challenges as well as today’s. As for our scale? In 2024 we delivered 2065 projects in 31 countries. We operate in three business units: Consulting, Products, and Capital. This gives us the holistic expertise our clients need to help them achieve greater success. Everything we deliver is measurable and sustainable. We accomplish this through our approach: • We are independent advisors • We listen, understand and adapt • We combine strategy with operational focus • We blend management and technology for maximum potential • We help our clients embrace change Our culture is defined by our purpose – ‘together, we are more than business’ – combined with three values that bring it to life: • We are easy to work with • We empower people to succeed • We create lasting outcomes Every day we’re working to deliver more for people, more innovation, and more for our planet. From AI to automation, strategy to sustainability, BearingPoint is helping our clients and their people to forge brighter futures.

Alvarez & Marsal

alvarezandmarsal.com

Alvarez & Marsal is a leading global professional services firm dedicated to helping organizations tackle their most complex business issues, maximize stakeholder value, and deliver sustainable change. Privately held since its founding in 1983, clients select us for our deep expertise and proven ability to create and deliver practical solutions to their unique problems. Leveraging A&M’s restructuring heritage, our fact-driven, action-oriented approach empowers organizations to drive transformation and unlock value at every stage of growth. Our worldwide network extends across six continents, with over 10,000 people comprised of experienced operators, world-class consultants, former regulators and industry authorities. We foster a uniquely collaborative environment that embraces our peoples’ diverse perspectives and A&M’s entrepreneurial spirit to deliver end-to-end capabilities that span advisory, business performance improvement, and turnaround management. When action matters, find us at www.alvarezandmarsal.com.

Korn Ferry

kornferry.com

Korn Ferry is a global consulting firm that powers performance. We unlock the potential in your people and unleash transformation across your business—synchronizing strategy, operations, and talent to accelerate performance, fuel growth, and inspire a legacy of change. That’s why the world’s most forward-thinking companies across every major industry turn to us—for a shared commitment to lasting impact and the bold ambition to Be More Than. As the Official Talent & Organizational Consulting Partner of LA28, Korn Ferry is powering the nearly 5,000 people who power the Olympics Games – bringing in the right talent, building strong leaders, and shaping the structure and culture that will deliver an unforgettable experience for the world.

Bain & Company

bain.com

Bain & Company is a global consultancy that helps the world’s most ambitious change makers define the future. Across 65 cities in 40 countries, we work alongside our clients as one team with a shared ambition to achieve extraordinary results, outperform the competition, and redefine industries. We complement our tailored, integrated expertise with a vibrant ecosystem of digital innovators to deliver better, faster, and more enduring outcomes. Our 10-year commitment to invest more than $1 billion in pro bono services brings our talent, expertise, and insight to organizations tackling today’s urgent challenges in education, racial equity, social justice, economic development, and the environment. We earned a platinum rating from EcoVadis, the leading platform for environmental, social, and ethical performance ratings for global supply chains, putting us in the top 1% of all companies. Since our founding in 1973, we have measured our success by the success of our clients, and we proudly maintain the highest level of client

ELIS

cb elis.com

As the leader in circular services at work, Elis ensures its clients achieve optimal hygiene, well-being and protection – everywhere, every day, in a sustainable way. We employ 54,000 people locally in 30 countries. We work for public and private organizations of all sizes, in all sectors of activity offering solutions for flat linen, workwear, facility, beverage, pest control, mats, wipers, cleanroom and medical waste. Our circular services help clients stay focused on their core business and allow them to reduce their environmental footprint. Our circular services inspire our commitment: they create a bond between us, our clients and our planet and they unite our people around the world. Elis is listed on Euronext Paris. --- Leader des services circulaires au travail, Elis veille à ce que ses clients bénéficient d'une hygiène, d'un bien-être et d'une protection optimale – partout dans le monde, tous les jours et de manière durable. Nous employons localement 54 000 collaborateurs dans 29 pays. Nous travaillons pour des organismes publics et privés de toutes tailles, dans tous les secteurs d’activité en leur offrant des solutions en vêtement de travail, linge plat, sanitaires, boisson, prévention nuisibles, tapis, essuyage industriel, salles propres et DASRI. Nos services circulaires aident nos clients à concentrer leurs efforts sur leur cœur de métier et leur permettent de réduire leur empreinte environnementale. Nos services circulaires inspirent notre engagement : ils créent un lien entre nous, nos clients et notre planète et unissent nos collaborateurs dans le monde entier. Elis est côté sur Euronext Paris et fait partie du SBF 120.

Loading…

NEWS

RCG | Risk Consulting Group CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

LevelBlue to buy Aon’s cybersecurity and IP litigation consulting groups

The integration complements LevelBlue's existing 24/7 managed detection and response services. Credit: sf_freelance/Shutterstock.

Read Article

Dallas’ LevelBlue To Acquire Aon’s Cybersecurity and IP Litigation Consulting Groups

When Dallas-based LevelBlue spun out from AT&T Cybersecurity in May, it wasn't your typical startup. As Bob McCullen, LevelBlue's chairman and ...

Read Article

Cyber Security Services | Cyber Risk

Kroll's elite cyber risk experts deliver end-to-end cyber security services for organizations in a wide range of sectors, across the globe.

Read Article

LevelBlue Agrees to Acquire Aon’s Cybersecurity & IP Litigation Consulting Groups

LevelBlue will strengthen its position at the intersection of managed security and cyber consulting services. By acquiring leading cybersecurity ...

Read Article

LevelBlue Expands Into Full-Spectrum Cyber Advisory with Aon’s Consulting Groups Acquisition

According to Robert McCullen, CEO of LevelBlue, “LevelBlue is already one of the largest pureplay MSSPs in the world, striving to simplify ...

Read Article

List of Women Owned Cybersecurity Companies In The U.S. And Internationally

CYPROTECK, Hartford, Conn. Founded by Cherie Griffith-Dunn, CYPROTECK provides top-tier protection for clients' sensitive data and assets ...

Read Article

Maritime Needs Decisive Action on Cyber Risk Says ABS Consulting Cyber Expert

“The maritime industry plays a critical role in global trade, making it an attractive target for cyber threats. By fostering greater ...

Read Article

InCorp Advisory, an Ascentium Company, strengthens Digital & Cyber Risk Practice with acquisition of Ken & Co.

This strategic expansion positions InCorp India as a Premier Cybersecurity and Risk Advisory with AI-enabled Assurance, Cybersecurity, ...

Read Article

LevelBlue to acquire Aon’s cybersecurity & IP litigation consulting groups

This platform will not only strengthen clients' defenses preemptively, but also empower them with deeper insights and faster incident resolution ...

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-86564

SUMMARY

A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: 3.3)

cvss3

Base Score: 3.3

Complexity: LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Impact Score

1.4

Exploitability

1.8

REFERENCES

CVE-2026-55250

SUMMARY

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low cache memory that causes premature eviction to free up memory and applications running macropay-solutions/maravel-framework that utilize tymon/jwt-auth for API token authentication and blacklist management or any other package that does the same may be affected. This architectural risk might also impact native Laravel applications utilizing cache tags under specific volatile or eviction-capped environments. tymon/jwt-auth automatically probes for cache tag support. If found, it forcefully wraps 14-day token blacklist entries (jti) inside a relational tymon.jwt tag. In environments where the O(1) Atomic Lazy Eviction model is active — either natively inside Maravel-Framework v20.x or manually backported into v10.x via the explicit DI container singletons provided in PR #104 (App\Cache\TaggedCache and App\Cache\TagSet) — a strict global tracking ceiling (Container::TAGGED_CACHE_TTL_CAP_SECONDS) of 7,200 seconds (2 hours) is enforced to secure the system against memory index bloat. This ceiling forcefully truncates the 14-day blacklist lifespan down to a maximum of 2 hours, after which individual tracking keys naturally expire and disappear from the active cache window. Furthermore, because the optimized engine implements a generational version matrix to achieve O(1) flush speeds, any programmatic or manual invocation of a tag flush or reset (e.g., Cache::tags([...])->flush()) instantly bumps the internal atomic master version pointer. This shifts the computed cryptographic composite hash (sha1($this->tags->getNamespace())) for all overlapping components, rendering the entire existing index immediately unreachable. Consequently, through either natural 2-hour expiration or an intervening tag flush execution (like the cache naturally cleaning old values to free up memory), the invalidation state records are entirely wiped out. Because the tokens' physical cryptographic signatures remain structurally valid for up to 14 days, stolen, hijacked, or legitimately logged-out tokens are instantly and silently resurrected across the entire API gateway, leaving the application critically vulnerable to widespread Token Replay Attacks. Because this issue is caused by an upstream architectural assumption within the tymon/jwt-auth package rather than a core defect inside the framework, there is no direct framework version upgrade that can safely bypass this lifecycle collision without breaking business cache recycling bounds. Maravel version 10.74.0 introduced a way to backport the new fixed tagged cache from 20.x into 10.x by resolving TagSet and TaggedCache from DI, which is how this latent architectural lifecycle vulnerability was discovered. Users must apply the decoupled configuration workaround outlined below. As a workaround, make sure that cache memory size does not generate early natural evictions from cache to free up space, deleting blacklisted jwt ids before they expire. Applications must decouple flat authentication vectors from the relational tagging subsystem. This forces token identifiers to write directly to the primary cache keyspace as flat, un-tagged key-value pairs where they securely retain their unclipped 14-day lifecycle.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: )

cvss4

Base Score: 8.7

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-53639

SUMMARY

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the `GET /api/v2/shop/payment-requests/{hash}` and `PUT /api/v2/shop/payment-requests/{hash}` endpoints look up the payment request solely by the hash from the URL. No ownership check is performed against the authenticated customer or the underlying order. An attacker who obtains a payment request hash can read the payment request and, through the `payment` IRI in the response, recover the underlying order's `tokenValue` (which itself grants access to the full order, items, addresses, customer email, totals); and/or update the payment request payload (e.g. `target_path`, `after_path`). These fields are used by the front-end controller to redirect the user after the payment, so an attacker can flip them to an attacker-controlled URL and intercept the buyer. The hash is a UUID, so it has to be obtained out-of-band (logs, shared links, referrer headers, a co-located client), but once it is known no other credential is required, neither authentication nor knowledge of the order token. The creation endpoint `POST /api/v2/shop/orders/{tokenValue}/payment-requests` shares the same flaw: it resolves the target order solely from the `tokenValue` in the URL without verifying that the caller owns the order. The issue is fixed in versions 2.0.18, 2.1.15, and 2.2.6. As a workaround, add a query extension that filters the `GET` operation; decorate the `PUT` state provider, guard the `POST` creation endpoint with a command-bus middleware, and wire the services.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: )

cvss4

Base Score: 6.3

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://github.com/Sylius/Sylius/security/advisories/GHSA-mr9r-h354-966r

CVE-2026-53638

SUMMARY

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass vulnerability exists in the shop account API. The `PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}` endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid (state `STATE_NEW`), does not validate that the chosen payment method is enabled for the order's channel. The equivalent checkout endpoint (`PATCH /api/v2/shop/orders/{tokenValue}/payments/{paymentId}`) correctly rejects out-of-channel payment methods with `HTTP 422`; the account endpoint silently accepts them and returns `HTTP 200`. An authenticated customer can therefore assign any globally enabled payment method to their own placed order, including methods that the store operator has explicitly excluded from that channel. The issue is fixed in versions: 2.0.18, 2.1.15, 2.2.6 and above. As a workaround, decorate the `Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface` service in the application.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: 4.3)

cvss3

Base Score: 4.3

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Impact Score

1.4

Exploitability

2.8

REFERENCES

https://github.com/Sylius/Sylius/security/advisories/GHSA-6955-hrm5-c4qp

CVE-2026-53637

SUMMARY

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart `FormComponent`. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched `FormComponent` into the application's `src/` directory and override the `sylius_shop.twig.component.cart.form` service definition to use that class.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: 6.5)

cvss3

Base Score: 6.5

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Impact Score

3.6

Exploitability

2.8

REFERENCES

https://github.com/Sylius/Sylius/security/advisories/GHSA-5597-7rmh-97q5

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…

Badge your company to reduce your risk score and your cyber insurance costs!

Trusted by insurers. Chosen by leaders.

RCG | Risk Consulting Group Vendor Cyber Rating & Cyber Score

RRCG A.I CyberSecurity Scoring

RCG | Risk Consulting Group CyberSecurity News & History

RRCG Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Incident Predictions locked

A.I Risk Score Likelihood 3 - 6 - 9 months

A.I. Risk Score Predictions locked

Underwriter Stats for RRCG

Incidents vs Business Consulting and Services Industry Avg (This Year)

Incidents vs All-Companies Average (This Year)

Incident Types RRCG vs Business Consulting and Services Industry Avg (This Year)

Incident History - RRCG (X = Date, Y = Severity)

RCG | Risk Consulting Group Subsidiaries

RRCG

RCG | Risk Consulting Group Similar Companies

Ayesa

PwC Deutschland

DKSH

EY-Parthenon

BearingPoint

Alvarez & Marsal

Korn Ferry

Bain & Company

ELIS

RCG | Risk Consulting Group CyberSecurity News

LevelBlue to buy Aon’s cybersecurity and IP litigation consulting groups

Dallas’ LevelBlue To Acquire Aon’s Cybersecurity and IP Litigation Consulting Groups

Cyber Security Services | Cyber Risk

LevelBlue Agrees to Acquire Aon’s Cybersecurity & IP Litigation Consulting Groups

LevelBlue Expands Into Full-Spectrum Cyber Advisory with Aon’s Consulting Groups Acquisition

List of Women Owned Cybersecurity Companies In The U.S. And Internationally

Maritime Needs Decisive Action on Cyber Risk Says ABS Consulting Cyber Expert

InCorp Advisory, an Ascentium Company, strengthens Digital & Cyber Risk Practice with acquisition of Ken & Co.

LevelBlue to acquire Aon’s cybersecurity & IP litigation consulting groups

Global CVEs (Not Company-Specific)

Access Data Using Our API

What Do We Measure ?

These are some of the factors we use to calculate the overall score:

Rankiteo

RCG | Risk Consulting Group CyberSecurity News & History

RRCG Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Incident Predictions locked

A.I Risk Score Likelihood 3 - 6 - 9 months

A.I. Risk Score Predictions locked

Underwriter Stats for RRCG

Incidents vs Business Consulting and Services Industry Avg (This Year)

Incidents vs All-Companies Average (This Year)

Incident Types RRCG vs Business Consulting and Services Industry Avg (This Year)

Incident History - RRCG (X = Date, Y = Severity)

RCG | Risk Consulting Group Subsidiaries

RRCG

RCG | Risk Consulting Group Similar Companies

Ayesa

PwC Deutschland

DKSH

EY-Parthenon

BearingPoint

Alvarez & Marsal

Korn Ferry

Bain & Company

ELIS

RCG | Risk Consulting Group CyberSecurity News

LevelBlue to buy Aon’s cybersecurity and IP litigation consulting groups

Dallas’ LevelBlue To Acquire Aon’s Cybersecurity and IP Litigation Consulting Groups

Cyber Security Services | Cyber Risk

LevelBlue Agrees to Acquire Aon’s Cybersecurity & IP Litigation Consulting Groups

LevelBlue Expands Into Full-Spectrum Cyber Advisory with Aon’s Consulting Groups Acquisition

List of Women Owned Cybersecurity Companies In The U.S. And Internationally

Maritime Needs Decisive Action on Cyber Risk Says ABS Consulting Cyber Expert

InCorp Advisory, an Ascentium Company, strengthens Digital & Cyber Risk Practice with acquisition of Ken & Co.

LevelBlue to acquire Aon’s cybersecurity & IP litigation consulting groups

Global CVEs (Not Company-Specific)

Access Data Using Our API

What Do We Measure ?

These are some of the factors we use to calculate the overall score:

Rankiteo