What is the official website of Sell on Amazon ?

The official website of Sell on Amazon is http://sell.amazon.com.

What is Sell on Amazon's cybersecurity risk score?

Sell on Amazon has an AI-generated cybersecurity risk score of 765 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has Sell on Amazon experienced?

According to Rankiteo, Sell on Amazon currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has Sell on Amazon been affected by any supply chain cyber incidents ?

According to Rankiteo, Sell on Amazon has been affected by multiple supply chain cyber incidents. The affected supply chain sources and their corresponding incident IDs are: Amazon Web Services (AWS) (Incident ID: HEAAMA1782153018) LiteLLM (Incident ID: LIT1783694475) SimpleHelp Ltd (Incident ID: SIM1781576629) npm, Inc. (Incident ID: ELAGITAMAOPENPM1780050263) Laravel (Incident ID: LAR1782311560) Socket (Incident ID: AWSSOC1778833973) Braintrust (Incident ID: AMAUSE1778092688) Amazon Web Services (AWS) (Incident ID: LIMAMA1777312775) Vercel (Incident ID: AMAVERGITSTR1775204764) Amazon Web Services (AWS) (Incident ID: AMASTA1775118743) Aqua Security (Incident ID: AQUUSEAMASALCIS1775046662) Amazon Web Services (AWS) (Incident ID: EUR1774635987) Amazon Web Services (AWS) (Incident ID: SALAMAMICPINRED1774269319) NPM (Incident ID: GOOAMANPMGIT1773319158) Amazon Web Services (AWS) (Incident ID: RELLEX1772562253) Amazon Web Services (AWS) (Incident ID: EUR1774628727) Amazon (Incident ID: AMAAPPMIC1770935300) ConnectWise (Incident ID: SMASIMCONAMADAT1775551328) Cisco (Incident ID: CISSAI1773859283) Amazon (Incident ID: LASAMA1769009064) LinkedIn (Incident ID: LINAWS1766995316) Microsoft Security (Incident ID: AMAORAMIC1770695748) Amazon Web Services (AWS) (Incident ID: AMAAWS1770152164) Cisco (Incident ID: SAL5732257091825) Wiz (Incident ID: AMAWIZ1768515615) NPM (Incident ID: GOONPMORGGOVAPPMETTHEAWSTIKK7-1773672350) Fortinet (Incident ID: FORCISAMAJPM1767748297)

Does Sell on Amazon have SOC 2 Type 1 certification ?

According to Rankiteo, Sell on Amazon is not certified under SOC 2 Type 1.

Does Sell on Amazon have SOC 2 Type 2 certification ?

According to Rankiteo, Sell on Amazon does not hold a SOC 2 Type 2 certification.

Does Sell on Amazon comply with GDPR ?

According to Rankiteo, Sell on Amazon is not listed as GDPR compliant.

Does Sell on Amazon have PCI DSS certification ?

According to Rankiteo, Sell on Amazon does not currently maintain PCI DSS compliance.

Does Sell on Amazon comply with HIPAA ?

According to Rankiteo, Sell on Amazon is not compliant with HIPAA regulations.

Does Sell on Amazon have ISO 27001 certification ?

According to Rankiteo,Sell on Amazon is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does Sell on Amazon operate in ?

Sell on Amazon operates primarily in the Technology, Information and Internet industry.

How many employees does Sell on Amazon have ?

Sell on Amazon employs approximately 9 people worldwide.

Does Sell on Amazon own any subsidiaries ?

Sell on Amazon presently has no subsidiaries across any sectors.

How many LinkedIn followers does Sell on Amazon have ?

Sell on Amazon's official LinkedIn profile has approximately 149,016 followers.

What is the NAICS classification code for Sell on Amazon ?

Sell on Amazon is classified under the NAICS code 513, which corresponds to Others.

Does Sell on Amazon have a Crunchbase profile ?

No, Sell on Amazon does not have a profile on Crunchbase.

Does Sell on Amazon have a LinkedIn profile ?

Yes, Sell on Amazon maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/sellwithamazon.

How many cybersecurity incidents has Sell on Amazon experienced ?

As of August 2, 2026, Rankiteo reports that Sell on Amazon has experienced 74 cybersecurity incidents.

How many peer or competitor companies does Sell on Amazon have ?

Sell on Amazon has an estimated 15,116 peer or competitor companies worldwide.

What types of cybersecurity incidents has Sell on Amazon faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability, Cyber Attack, Breach, Ransomware and Data Leak.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

Boost Score +25 with badge (5 left)

765

/1000

Fair

790

/1000

Fair

Sell on Amazon Vendor Cyber Rating & Cyber Score

amazon.com

Add Your Compliance Badge

There are many reasons to sell in Amazon's store—from the hundreds of millions of Amazon customers who can see your products to the ability to start selling fast without the need to create a new standalone website.

SA A.I CyberSecurity Scoring

Scoring History

Sell on Amazon CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

Amazon Science

Vulnerability

100

7/2026

AMAORATUXROC178...

Amazon Science

Vulnerability

7/2026

ANYWINGOOAMAAUG...

Amazon

Vulnerability

6/2026

AMA1782498585

Amazon Web Services...

Vulnerability

6/2026

AMA1782541446

Amazon Web Services...

Vulnerability

6/2026

Amazon Web Serv...

HEAAMA178215301...

Amazon

Vulnerability

100

6/2026

ANTAMA178355044...

Amazon Web Services...

Vulnerability

6/2026

LiteLLM

LIT1783694475

AWS Startups

Vulnerability

100

6/2026

SimpleHelp Ltd

SIM1781576629

Amazon Web Services...

Cyber Attack

100

6/2026

GOOAMA178116664...

Amazon Web Services...

Cyber Attack

5/2026

npm, Inc.

ELAGITAMAOPENPM...

Amazon Science

Vulnerability

5/2026

OPEANTAMAXAI177...

Amazon Web Services...

Vulnerability

100

5/2026

Laravel

LAR1782311560

AWS for Healthcare ...

Cyber Attack

5/2026

Socket

AWSSOC177883397...

Amazon Science

Breach

5/2026

Braintrust

AMAUSE177809268...

Amazon Web Services...

Vulnerability

100

5/2026

APPGOOAMA178163...

Amazon Web Services...

Cyber Attack

4/2026

Amazon Web Serv...

LIMAMA177731277...

Amazon

Cyber Attack

4/2026

ELFTEMCOUGRUAMA...

Amazon Web Services...

Cyber Attack

4/2026

Vercel

AMAVERGITSTR177...

Amazon Web Services...

Vulnerability

100

4/2026

Amazon Web Serv...

AMASTA177511874...

AWS Partners

Vulnerability

4/2026

AWSGITSTR177516...

Amazon Web Services...

Vulnerability

100

4/2026

Aqua Security

AQUUSEAMASALCIS...

Amazon Web Services...

Vulnerability

100

3/2026

DELMICAMAFORSPL...

Amazon Web Services...

Cyber Attack

3/2026

Amazon Web Serv...

EUR1774635987

Amazon Web Services...

Vulnerability

100

3/2026

Amazon Web Serv...

SALAMAMICPINRED...

Amazon Web Services...

Vulnerability

3/2026

AMA1773707045

Amazon Web Services...

Cyber Attack

3/2026

NPM

GOOAMANPMGIT177...

Amazon Web Services...

Vulnerability

3/2026

AMA1772792723

Amazon Web Services...

Cyber Attack

100

3/2026

AMA1772678135

Amazon Web Services...

Breach

100

3/2026

Amazon Web Serv...

RELLEX177256225...

Amazon

Cyber Attack

3/2026

AMA1775744757

Amazon Web Services...

Breach

3/2026

Amazon Web Serv...

EUR1774628727

Amazon

Vulnerability

100

2/2026

Amazon

AMAAPPMIC177093...

Amazon

Cyber Attack

2/2026

ConnectWise

SMASIMCONAMADAT...

Amazon

Breach

2/2026

AMA1770339008

Amazon

Cyber Attack

2/2026

AMAINSCOIGOOFLI...

Amazon

Cyber Attack

2/2026

AMA1773987972

AWS Partners

Breach

1/2026

AWSDIGOVH176978...

Amazon

Vulnerability

100

1/2026

Cisco

CISSAI177385928...

Amazon

Cyber Attack

1/2026

Amazon

LASAMA176900906...

AWS Databases & Ana...

Cyber Attack

1/2026

HUNAWS177273537...

Amazon Web Services...

Vulnerability

100

1/2026

GOOAMAOPEANT177...

AWS Partners

Cyber Attack

12/2025

LINAWS176699531...

Amazon Web Services...

Cyber Attack

100

12/2025

Microsoft Secur...

AMAORAMIC177069...

Amazon

Vulnerability

12/2025

AMAUNIGOOWAK176...

Amazon Web Services...

Cyber Attack

100

12/2025

KUBNVITENALIAMA...

Amazon Web Services...

Breach

100

11/2025

Amazon Web Serv...

AMAAWS177015216...

Amazon Web Services...

Cyber Attack

11/2025

AMA1765965358

AWS Databases & Ana...

Cyber Attack

100

11/2025

AWS1783621498

Sell on Amazon

Cyber Attack

100

10/2025

AMA023220210212...

Sell on Amazon

Cyber Attack

9/2025

AMA409264009232...

AWS Partners

Cyber Attack

100

9/2025

Cisco

SAL573225709182...

Amazon Web Services...

Vulnerability

100

9/2025

Wiz

AMAWIZ176851561...

For Industries

Vulnerability

8/2025

NPM

GOONPMORGGOVAPP...

Sell on Amazon

Cyber Attack

7/2025

RIN709072225

Sell on Amazon

Vulnerability

6/2025

AMA505082225

Sell on Amazon

Ransomware

100

5/2025

AMA503215011212...

Amazon Web Services...

Vulnerability

100

12/2024

Fortinet

FORCISAMAJPM176...

Sell on Amazon

Vulnerability

8/2024

AMA000082124

Sell on Amazon

Breach

7/2024

AMA000072524

Sell on Amazon

Cyber Attack

100

6/2024

AMA190211910222...

Sell on Amazon

Breach

09/2023

WHO04111223

Sell on Amazon

Vulnerability

6/2023

AMA016210111072...

Sell on Amazon

Data Leak

10/2021

TWI19174123

Amazon Web Services...

Cyber Attack

100

6/2021

AMA1768595116

Sell on Amazon

Breach

100

01/2021

RIN01518622

Amazon Web Services...

Cyber Attack

100

6/2020

AMA1780793273

Sell on Amazon

Data Leak

01/2020

AMA21461222

Sell on Amazon

Data Leak

01/2020

RIN211261222

Sell on Amazon

Data Leak

12/2019

RIN2178523

Amazon Web Services...

Vulnerability

3/2019

AMA1781685326

Amazon

Breach

6/2018

TIKAMA176901658...

Sell on Amazon

Data Leak

02/2018

AMA350181223

Sell on Amazon

Breach

3/2017

WHO631090125

Sell on Amazon

Cyber Attack

01/2016

AMA0417522

Loading…

A.I.

SA Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for SA

Incidents vs Technology, Information and Internet Industry Avg (This Year)

No incidents recorded for Sell on Amazon in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for Sell on Amazon in 2026.

Incident Types SA vs Technology, Information and Internet Industry Avg (This Year)

No incidents recorded for Sell on Amazon in 2026.

Incident History - SA (X = Date, Y = Severity)

Loading…

SUBSIDIARY

Sell on Amazon Subsidiaries

SA

Technology, Information and Internet

Website: http://sell.amazon.com

Company Size: 1,001-5,000 employees

AmazonSoftware Development

TwitchSoftware Development

Twitch AdsInternet Publishing

Souq.comTechnology, Information and Internet

Transportation, Shipping, & Logistics at AmazonTransportation, Logistics, Supply Chain and Storage

ShopbopRetail

Loading…

Sell on Amazon Similar Companies

Lenskart.com

lenskart.com

At Lenskart, we believe that clear vision is fundamental to the personal development and well-being of an individual, and our aim is to build tech-enabled solutions that improve access to affordable and quality ‘Eyewear for All’. We commenced our operations in India as an online business in 2010 and opened our first retail store in New Delhi in 2013. Since then, we have scaled through both the online and offline channels and have established a presence through our retail stores, websites, mobile applications, and other channels.

IndiaMART InterMESH Limited

cb indiamart.com

IndiaMART is India's largest online B2B marketplace, connecting buyers with suppliers across a wide array of industries. IndiaMART provides a platform for Small & Medium Enterprises (SMEs), large enterprises, and individual buyers, helping them access diverse portfolios of quality products. Since 1999, IndiaMART’s mission has been to make doing business easy. Today, over 21.9 Crore buyers can explore and choose from 12.4 Crore products, sourced from 86 Lakh suppliers, creating a one-stop platform for all business needs. IndiaMART offers enhanced business visibility and credibility for suppliers, with tools designed to support business growth and operational efficiency. With a dedicated workforce of over 5000 employees across India, IndiaMART continues to facilitate seamless connections and provide a trusted marketplace for businesses to thrive.

Fanatics

fanaticsinc.com

Fanatics is a leading global digital sports platform. We ignite the passions of global sports fans and maximize the presence and reach for our hundreds of sports partners globally by offering products and services across Fanatics Commerce, Fanatics Collectibles, and Fanatics Betting & Gaming, allowing sports fans to Buy, Collect, and Bet. Through the Fanatics platform, sports fans can buy licensed fan gear, jerseys, lifestyle and streetwear products, headwear, and hardgoods; collect physical and digital trading cards, sports memorabilia, and other digital assets; and bet as the company builds its Sportsbook and iGaming platform. Fanatics has an established database of over 100 million global sports fans; a global partner network with approximately 900 sports properties, including major national and international professional sports leagues, players associations, teams, colleges, college conferences and retail partners, 2,500 athletes and celebrities, and 200 exclusive athletes; and over 2,000 retail locations, including its Lids retail stores. Our more than 22,000 employees are committed to relentlessly enhancing the fan experience and delighting sports fans globally.

Swiggy

swiggy.com

Swiggy is India’s pioneering on-demand convenience platform, catering to millions of consumers each month. Founded in 2014, its mission is to elevate the quality of life for the urban consumer by offering unparalleled convenience. With an extensive footprint in food delivery, Swiggy Food collaborates with nearly 2 lakh restaurants across 600+ cities. Swiggy Instamart, its quick commerce platform operating in 120+ cities, delivers groceries and other essentials across 40+ categories in 10 minutes. Fueled by a commitment to innovation, Swiggy continually incubates and integrates new services like Swiggy Dineout and Swiggy Genie into its multi-service app. Leveraging cutting-edge technology and Swiggy One, the country’s only membership program offering benefits across food, quick commerce, dining out, and pick-up and drop services, Swiggy aims to provide a superior experience to its consumers. For more information, visit www.swiggy.com

YouTube

cb youtube.com

YouTube is a team-oriented, creative workplace where every single employee has a voice in the choices we make and the features we implement. We work together in small teams to design, develop, and roll out key features and products in very short time frames. Which means something you write today could be seen by millions of viewers tomorrow. And even though we’re a part of Google and enjoy all of the corporate perks, it still feels like you’re working at a startup. YouTube is headquartered in San Bruno, California, 12 miles south of San Francisco. We also have many job openings in Mountain View, and across the globe

Everforth

everforth.com

Everforth, Inc. (NYSE: EFOR) is a leading technology and digital engineering company that helps organizations adapt, innovate, and thrive in a world of constant change. Our six solution areas — AI and data, cloud and infrastructure, application and digital engineering, experience, cybersecurity, and enterprise platforms — accelerate time to value for our commercial and federal clients. Powered by proprietary assets, accelerators, and proven expertise, Everforth turns complexity into progress and delivers measurable outcomes. Everforth: Adapt and Thrive™.

Meesho

meesho.io

Meesho is India’s e-commerce marketplace, on a mission to democratise internet commerce. Our multi-sided technology platform connects four key stakeholders — consumers, sellers, logistics partners, and content creators — to power inclusive growth at scale. We enable individuals and small businesses to sell online with ease, offering access to a wide customer base, integrated logistics, payment solutions, and platform support. For customers, Meesho offers a broad and affordable selection, tailored for diverse needs across Bharat. We also empower creators to build commerce-driven content that drives discovery and engagement. Our logistics operations are powered by Valmo, Meesho’s asset-light logistics platform that works entirely through partner-led infrastructure to ensure cost-efficient and scalable deliveries.

Cimpress

cb cimpress.com

Cimpress plc (Nasdaq: CMPR) invests in and builds customer-focused, entrepreneurial, mass-customization businesses for the long term. Mass customization is a competitive strategy which seeks to produce goods and services to meet individual customer needs with near mass production efficiency. Cimpress is a strategically-focused group of more than a dozen businesses, each operating in a largely autonomous manner other than as it relates to the select few shared strategic and corporate activities that we maintain centrally. Cimpress businesses include Drukwerkdeal, Exaprint, National Pen, Pixartprinting, Printi, Vistaprint and WIRmachenDRUCK. Founded by Robert Keane, who remains President & CEO today, the company has been passionate about empowering people to make an impression through individually meaningful, personalized physical products for more than 20 years. To learn more, visit http://www.cimpress.com.

Delivery Hero

deliveryhero.com

As the world’s leading local delivery platform, our mission is to deliver an amazing experience, fast, easy, and to your door. We operate in over 70+ countries worldwide, powered by tech but driven by people. As one of Europe’s largest tech platforms, we enable ambitious talent to deliver solutions that create impact within our ecosystem. We move fast, take action, and adapt. No matter where you’re from or what you believe in, we build, we deliver, we lead. We are Delivery Hero.

Loading…

NEWS

Sell on Amazon CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

January 30, 2026 08:00 AM

Researchers Uncover Chrome Extensions Abusing Affiliate Links and Stealing ChatGPT Access

Cybersecurity researchers have discovered malicious Google Chrome extensions that come with capabilities to hijack affiliate links,...

Read Article

January 26, 2026 08:00 AM

7 Top Nancy Pelosi Stocks to Buy

Former House Speaker Nancy Pelosi said back in 2022 the Senate would soon vote on a bill banning members of Congress from trading individual...

Read Article

January 16, 2026 08:00 AM

The Jackery Explorer 1000 v2 power station is back on sale at Amazon — save $400 right now

SAVE OVER $400: As of Jan. 16, the Jackery Explorer 1000 v2 is on sale for $398.99 at Amazon. That's 50% off the list price.

Read Article

December 22, 2025 08:00 AM

A comprehensive list of 2025 tech layoffs

A complete list of all the known layoffs in tech, from Big Tech to startups, broken down by month throughout 2024 and 2025.

Read Article

December 18, 2025 08:00 AM

North Korean infiltrator caught working in Amazon IT department thanks to lag — 110ms keystroke input raises red flags over true location [Updated]

A barely perceptible keystroke delay was the smoking gun that led to the uncovering of a malign imposter.

Read Article

December 12, 2025 08:00 AM

The Roku Streaming Stick Plus is back on sale at Amazon — save over $10 right now

SAVE $10.99: As of Dec. 12, the Roku Streaming Stick Plus is on sale for $29 at Amazon. That's a 27% saving on the list price.

Read Article

December 03, 2025 08:00 AM

How Amazon Finds Its Cybersecurity Weak Spots

Chief Security Officer Stephen Schmidt burrows into the billions of data points spun out of Amazon's tech infrastructure.

Read Article

December 01, 2025 08:00 AM

Nintendo Switch 2 bundles quickly sold out at Amazon — here's where to find them in stock (and on sale)

Nintendo Switch 2 + Mario Kart World Bundles are on sale at Walmart for Cyber Monday for $449, or $50 off. That's a rare 10% discount on a...

Read Article

November 26, 2025 08:00 AM

Amazon warns its 310 million-plus users of fraud and hacking as Black Friday sale 2025 goes live: How to

Tech News News: Amazon issued a security warning to US users on November 24, urging vigilance against a surge of fraud and scams targeting...

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-18556

SUMMARY

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://uptime.n-able.com/

CVE-2026-55735

SUMMARY

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55734

SUMMARY

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55733

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-54894

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…