EC
Company Details
Linkedin ID:
the-electoral-commission
Employees number:
539
Number of followers:
7,504
NAICS:
921
Industry Type:
Homepage:
electoralcommission.org.uk
IP Addresses:
0
Company ID:
THE_1582011
Scan Status:
In-progress
The Electoral Commission Company CyberSecurity Posture
electoralcommission.org.uk
We are the independent body which oversees elections and regulates political finance in the UK. We work to promote public confidence in the democratic process and ensure its integrity. We enable the delivery of free and fair elections and referendums. This includes focussing on the needs of voters and addressing the changing environment to ensure every vote remains secure and accessible. We regulate political finance – taking proactive steps to increase transparency, ensure compliance and pursue breaches. We use our expertise to make and advocate for changes to our democracy, aiming to improve fairness, transparency and efficiency. We have UK wide responsibilities and are accountable to the UK Parliament, the Scottish Parliament and the Senedd. Our work is directed to meeting the needs of each of the four parts of the UK.
The Electoral Commission A.I CyberSecurity Scoring
EC Risk Score (AI oriented)Between 700 and 749
EC
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
EC Global Score (TPRM)XXXX
EC
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
EC Company CyberSecurity News & History
Past Incidents
2
Attack Types
2
UK Electoral Commission
Cyber Attack
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: The UK’s Electoral Commission suffered a prolonged cyberattack that went undetected for an extended period, with hackers infiltrating its IT networks for at least three years. While no evidence of election tampering was found during six by-elections held during the breach, the intrusion exposed millions of British voters to potential risks. The Commission faced a formal reprimand from the Information Commissioner’s Office (ICO) due to security lapses, highlighting vulnerabilities in democratic systems. Recovery took three years and required a £250,000 grant, with additional long-term investments in cybersecurity. Despite the recovery, the organization remains uncertain about what data was exfiltrated or the attackers’ objectives. The incident underscored the growing threat to electoral systems globally, forcing the Commission to adopt stricter security measures to prevent future breaches and protect democratic integrity.
The Electoral Commission
Data Leak
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: A cyber attack that revealed the data of tens of millions of UK voters is thought to have been orchestrated by Russia, prompting concerns that it was an attempt to undermine democracy. The Electoral Commission acknowledged that hackers had gained access to files containing the names and addresses of the 40 million persons registered to vote between 2014 and 2022 in reference to copies of electoral registers. They expressed regret to individuals impacted and assured the public that "significant" steps had been taken to strengthen the security of the systems used by the watchdog.
EC Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for EC
Incidents vs Public Policy Offices Industry Average (This Year)
The Electoral Commission has 20.48% more incidents than the average of same-industry companies with at least one recorded incident.
Incidents vs All-Companies Average (This Year)
The Electoral Commission has 56.25% more incidents than the average of all companies with at least one recorded incident.
Incident Types EC vs Public Policy Offices Industry Avg (This Year)
The Electoral Commission reported 1 incidents this year: 1 cyber attacks, 0 ransomware, 0 vulnerabilities, 0 data breaches, compared to industry peers with at least 1 incident.
Incident History — EC (X = Date, Y = Severity)
EC cyber incidents detection timeline including parent company and subsidiaries
EC Company Subsidiaries
We are the independent body which oversees elections and regulates political finance in the UK. We work to promote public confidence in the democratic process and ensure its integrity. We enable the delivery of free and fair elections and referendums. This includes focussing on the needs of voters and addressing the changing environment to ensure every vote remains secure and accessible. We regulate political finance – taking proactive steps to increase transparency, ensure compliance and pursue breaches. We use our expertise to make and advocate for changes to our democracy, aiming to improve fairness, transparency and efficiency. We have UK wide responsibilities and are accountable to the UK Parliament, the Scottish Parliament and the Senedd. Our work is directed to meeting the needs of each of the four parts of the UK.
Loading...
EC Similar Companies
Gezinsbond
De Gezinsbond is de grootste onafhankelijke gezinsorganisatie van het land. We verdedigen de belangen van álle gezinnen in Vlaanderen en Brussel. Los van religieuze, ideologische of politieke opvattingen. En ongeacht de samenstelling van de gezinnen. Het belang van de kinderen staat altijd voorop.
NW Energy Coalition
The NW Energy Coalition is an alliance of around 100 environmental, civic, and human service organizations, progressive utilities, and businesses in Oregon, Washington, Idaho, Montana and British Columbia. We promote development of renewable energy and energy conservation, consumer protection, low-i
Virginia Department of Business Assistance
The Virginia Department of Business Assistance, created by the Virginia General Assembly in 1996, provides a one-stop-service for technical assistance related to business formation, access to capital, and workforce development. VDBA works with existing businesses as they grow their workforce and men
GMP+ International
We believe that animal feed should be safe for animals, people and our planet. That is why we have developed a certification scheme that allows every company in the feed chain to take responsibility for safe and sustainable feed. Today, almost 20,000 companies in 93 countries are GMP+ certified. We
CACF: Coalition for Asian American Children and Families
The Coalition for Asian American Children and Families (CACF) is the nation's only pan-Asian children's advocacy organization. CACF's mission is to improve the health and well-being of Asian Pacific American children and families in New York City. CACF believes that children of all backgrounds
John C. Stennis Institute of Government
The John C. Stennis Institute of Government performs a threefold mission: (1) to enhance the efficiency and effectiveness of Mississippi state and local governments through basic and applied research, training, technical assistance, and service; (2) to provide technical assistance and research for b
.png)
EC CyberSecurity News
November 12, 2025 01:05 PM
The Defense Ministry announces use of cybersecurity and AI in the election security plan » Iraqi News Agency
INA- Baghdad The Ministry of Defense announced on Wednesday the new logistical and technical capabilities incorporated into the election security plan,...
October 29, 2025 07:00 AM
Helping protect the 2025 Moldova elections
Cloudflare mitigated a 12-hour DDoS attack against Moldova's Central Election Commission, blocking over 898 million malicious requests that...
September 28, 2025 07:00 AM
Moldova casts blame on Russia for attempts to disrupt pivotal parliamentary elections
Bomb threats were also reported at polling stations for the Moldovan diaspora in Belgium, Italy, Romania, Spain, and the U.S.,...
September 26, 2025 07:00 AM
Moldova’s electoral commission suffered cyberattack days ahead of vote
Sunday's vote is mired in “most advanced hybrid threats of our times,” deputy prime minister tells POLITICO.
September 26, 2025 07:00 AM
Iraq’s electoral commission probes campaign violations for AI
ERBIL, Kurdistan Region - Iraq's electoral commission is investigating allegations of campaign violations for the use of Artificial...
September 24, 2025 07:00 AM
Former IAS officer flags Election Commission of India website’s low cybersecurity score
The ECI website got a score of 15/100 on the Mozilla HTTP Observatory, which checks for certain basic cybersecurity hygiene measures; the score...
September 23, 2025 07:00 AM
‘Our worst day’: The untold story of the Electoral Commission cyber attack
As head of digital at the Electoral Commission, Andrew Simpson's mettle was tested when threat actors gained access to the regulator's email...
September 11, 2025 07:00 AM
Electoral Commission admits 'painful lessons learned' after Chinese hack
The Electoral Commission has revealed that it has taken three years and more than £250000 to fully recover from a devastating cyberattack...
September 10, 2025 07:00 AM
UK Electoral Commission finally recovered from China hack after three years and £250,000 grant
After three long years, the UK's Electoral Commission is finally fully recovered after a cyberattack that left the organisation reeling.
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
EC CyberSecurity History Information
Official Website of The Electoral Commission
The official website of The Electoral Commission is http://www.electoralcommission.org.uk.
The Electoral Commission’s AI-Generated Cybersecurity Score
According to Rankiteo, The Electoral Commission’s AI-generated cybersecurity score is 704, reflecting their Moderate security posture.
How many security badges does The Electoral Commission’ have ?
According to Rankiteo, The Electoral Commission currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does The Electoral Commission have SOC 2 Type 1 certification ?
According to Rankiteo, The Electoral Commission is not certified under SOC 2 Type 1.
Does The Electoral Commission have SOC 2 Type 2 certification ?
According to Rankiteo, The Electoral Commission does not hold a SOC 2 Type 2 certification.
Does The Electoral Commission comply with GDPR ?
According to Rankiteo, The Electoral Commission is not listed as GDPR compliant.
Does The Electoral Commission have PCI DSS certification ?
According to Rankiteo, The Electoral Commission does not currently maintain PCI DSS compliance.
Does The Electoral Commission comply with HIPAA ?
According to Rankiteo, The Electoral Commission is not compliant with HIPAA regulations.
Does The Electoral Commission have ISO 27001 certification ?
According to Rankiteo,The Electoral Commission is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of The Electoral Commission
The Electoral Commission operates primarily in the Public Policy Offices industry.
Number of Employees at The Electoral Commission
The Electoral Commission employs approximately 539 people worldwide.
Subsidiaries Owned by The Electoral Commission
The Electoral Commission presently has no subsidiaries across any sectors.
The Electoral Commission’s LinkedIn Followers
The Electoral Commission’s official LinkedIn profile has approximately 7,504 followers.
NAICS Classification of The Electoral Commission
The Electoral Commission is classified under the NAICS code 921, which corresponds to Executive, Legislative, and Other General Government Support.
The Electoral Commission’s Presence on Crunchbase
No, The Electoral Commission does not have a profile on Crunchbase.
The Electoral Commission’s Presence on LinkedIn
Yes, The Electoral Commission maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/the-electoral-commission.
Cybersecurity Incidents Involving The Electoral Commission
As of November 27, 2025, Rankiteo reports that The Electoral Commission has experienced 2 cybersecurity incidents.
Number of Peer and Competitor Companies
The Electoral Commission has an estimated 1,025 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at The Electoral Commission ?
Incident Types: The types of cybersecurity incidents that have occurred include Data Leak and Cyber Attack.
What was the total financial impact of these incidents on The Electoral Commission ?
Total Financial Loss: The total financial loss from these incidents is estimated to be $250 thousand.
How does The Electoral Commission detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an remediation measures with significant steps to strengthen the security of the systems, and and remediation measures with increased cybersecurity budget, remediation measures with enhanced security protections, and recovery measures with 3-year recovery process, recovery measures with use of £250,000 grant, and communication strategy with ceo interview with bbc, communication strategy with public acknowledgment of incident, and .
Incident Details
Can you provide details on each incident ?
Title: Cyber Attack on UK Voter Data
Description: A cyber attack that revealed the data of tens of millions of UK voters is thought to have been orchestrated by Russia, prompting concerns that it was an attempt to undermine democracy.
Type: Data Breach
Threat Actor: Russia
Motivation: Undermine democracy
Title: Cyberattack on the UK's Electoral Commission
Description: The UK's Electoral Commission recovered from a cyberattack after three years and £250,000 in recovery costs. The intrusion left millions of British voters vulnerable, though no evidence of tampering was found during six by-elections held while hackers were inside the IT networks. The Commission remains unaware of what information was exfiltrated or the hackers' goals. The incident highlighted vulnerabilities in democratic and electoral systems, prompting increased cybersecurity investments.
Type: cyber intrusion
Vulnerability Exploited: insufficient security protectionslapses in cybersecurity measures
Motivation: potential disruption of democracyundermining government processesunknown specific goals
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Cyber Attack.
Impact of the Incidents
What was the impact of each incident ?
Incident : Data Breach THE71710823
Data Compromised: Names and addresses of 40 million persons registered to vote between 2014 and 2022
Incident : cyber intrusion THE5292352091025
Financial Loss: £250,000 (recovery grant) + increased cybersecurity budget
Data Compromised: Unknown (potential exposure of voter data), No evidence of tampering in by-elections
Systems Affected: IT networks
Downtime: 3 years (recovery period)
Operational Impact: long-term recovery effortreputation damageregulatory reprimand
Brand Reputation Impact: formal reprimand by Information Commissioner's Office (ICO)loss of public trust in electoral security
Legal Liabilities: regulatory reprimand
Identity Theft Risk: ['potential risk to millions of voters']
What is the average financial loss per incident ?
Average Financial Loss: The average financial loss per incident is $125.00 thousand.
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personal Information, Potentially Voter Data, Unknown Specifics and .
Which entities were affected by each incident ?
Incident : Data Breach THE71710823
Entity Name: Electoral Commission
Entity Type: Government Agency
Industry: Government
Location: United Kingdom
Customers Affected: 40 million voters
Incident : cyber intrusion THE5292352091025
Entity Name: UK Electoral Commission
Entity Type: government agency
Industry: elections and democracy
Location: United Kingdom
Customers Affected: millions of British voters (potential exposure)
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach THE71710823
Remediation Measures: Significant steps to strengthen the security of the systems
Incident : cyber intrusion THE5292352091025
Incident Response Plan Activated: True
Remediation Measures: increased cybersecurity budgetenhanced security protections
Recovery Measures: 3-year recovery processuse of £250,000 grant
Communication Strategy: CEO interview with BBCpublic acknowledgment of incident
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach THE71710823
Type of Data Compromised: Personal Information
Number of Records Exposed: 40 million
Sensitivity of Data: High
Personally Identifiable Information: Names and addresses
Incident : cyber intrusion THE5292352091025
Type of Data Compromised: Potentially voter data, Unknown specifics
Number of Records Exposed: millions (potential)
Sensitivity of Data: high (voter information)
Data Exfiltration: unknown if data was exfiltrated
Personally Identifiable Information: potential PII of voters
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Significant steps to strengthen the security of the systems, increased cybersecurity budget, enhanced security protections, .
Ransomware Information
Was ransomware involved in any of the incidents ?
Incident : cyber intrusion THE5292352091025
Data Exfiltration: ['unknown']
How does the company recover data encrypted by ransomware ?
Data Recovery from Ransomware: The company recovers data encrypted by ransomware through 3-year recovery process, use of £250,000 grant, .
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : cyber intrusion THE5292352091025
Regulations Violated: UK data protection laws (implied by ICO reprimand),
Legal Actions: formal reprimand by Information Commissioner's Office (ICO),
Regulatory Notifications: ICO notification and reprimand
How does the company ensure compliance with regulatory requirements ?
Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through formal reprimand by Information Commissioner's Office (ICO), .
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : cyber intrusion THE5292352091025
Lessons Learned: Democratic and electoral systems are high-value targets for cyberattacks., Complacency in cybersecurity can lead to severe vulnerabilities., Proactive investment in cybersecurity is critical for public trust and operational resilience., Incident recovery can be prolonged and costly without adequate preparations.
What recommendations were made to prevent future incidents ?
Incident : cyber intrusion THE5292352091025
Recommendations: Conduct regular cybersecurity audits and penetration testing., Implement multi-layered security controls, including network segmentation and monitoring., Increase awareness and training for staff on cyber threats targeting electoral processes., Develop and test incident response plans to reduce recovery time., Collaborate with government cybersecurity agencies for threat intelligence sharing.Conduct regular cybersecurity audits and penetration testing., Implement multi-layered security controls, including network segmentation and monitoring., Increase awareness and training for staff on cyber threats targeting electoral processes., Develop and test incident response plans to reduce recovery time., Collaborate with government cybersecurity agencies for threat intelligence sharing.Conduct regular cybersecurity audits and penetration testing., Implement multi-layered security controls, including network segmentation and monitoring., Increase awareness and training for staff on cyber threats targeting electoral processes., Develop and test incident response plans to reduce recovery time., Collaborate with government cybersecurity agencies for threat intelligence sharing.Conduct regular cybersecurity audits and penetration testing., Implement multi-layered security controls, including network segmentation and monitoring., Increase awareness and training for staff on cyber threats targeting electoral processes., Develop and test incident response plans to reduce recovery time., Collaborate with government cybersecurity agencies for threat intelligence sharing.Conduct regular cybersecurity audits and penetration testing., Implement multi-layered security controls, including network segmentation and monitoring., Increase awareness and training for staff on cyber threats targeting electoral processes., Develop and test incident response plans to reduce recovery time., Collaborate with government cybersecurity agencies for threat intelligence sharing.
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are Democratic and electoral systems are high-value targets for cyberattacks.,Complacency in cybersecurity can lead to severe vulnerabilities.,Proactive investment in cybersecurity is critical for public trust and operational resilience.,Incident recovery can be prolonged and costly without adequate preparations.
References
Where can I find more information about each incident ?
Incident : cyber intrusion THE5292352091025
Source: BBC Interview with Electoral Commission CEO Vijay Rangarajan
Incident : cyber intrusion THE5292352091025
Source: TechRadar Pro Article
Incident : cyber intrusion THE5292352091025
Source: Information Commissioner's Office (ICO) Reprimand
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: BBC Interview with Electoral Commission CEO Vijay Rangarajan, and Source: TechRadar Pro Article, and Source: Information Commissioner's Office (ICO) Reprimand.
Investigation Status
What is the current status of the investigation for each incident ?
Incident : cyber intrusion THE5292352091025
Investigation Status: Completed (recovery phase over, but specifics of breach remain unclear)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Ceo Interview With Bbc and Public Acknowledgment Of Incident.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : cyber intrusion THE5292352091025
Customer Advisories: Public statements acknowledging the incident and recovery efforts
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Public Statements Acknowledging The Incident And Recovery Efforts and .
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : cyber intrusion THE5292352091025
Backdoors Established: ['likely (hackers were inside for extended period)']
High Value Targets: Voter Data, Electoral Processes,
Data Sold on Dark Web: Voter Data, Electoral Processes,
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : cyber intrusion THE5292352091025
Root Causes: Insufficient Cybersecurity Protections, Lack Of Awareness Of Electoral Systems As High-Value Targets, Potential Complacency In Security Practices,
Corrective Actions: Significant Increase In Cybersecurity Budget, Enhanced Monitoring And Security Measures, Greater Emphasis On Threat Awareness And Preparedness,
What corrective actions has the company taken based on post-incident analysis ?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Significant Increase In Cybersecurity Budget, Enhanced Monitoring And Security Measures, Greater Emphasis On Threat Awareness And Preparedness, .
Additional Questions
General Information
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident was an Russia.
Impact of the Incidents
What was the highest financial loss from an incident ?
Highest Financial Loss: The highest financial loss from an incident was £250,000 (recovery grant) + increased cybersecurity budget.
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Names and addresses of 40 million persons registered to vote between 2014 and 2022, unknown (potential exposure of voter data), no evidence of tampering in by-elections and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident was IT networks.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were no evidence of tampering in by-elections, Names and addresses of 40 million persons registered to vote between 2014 and 2022 and unknown (potential exposure of voter data).
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 40.0M.
Regulatory Compliance
What was the most significant legal action taken for a regulatory violation ?
Most Significant Legal Action: The most significant legal action taken for a regulatory violation was formal reprimand by Information Commissioner's Office (ICO), .
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Incident recovery can be prolonged and costly without adequate preparations.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Conduct regular cybersecurity audits and penetration testing., Increase awareness and training for staff on cyber threats targeting electoral processes., Develop and test incident response plans to reduce recovery time., Collaborate with government cybersecurity agencies for threat intelligence sharing., Implement multi-layered security controls and including network segmentation and monitoring..
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are BBC Interview with Electoral Commission CEO Vijay Rangarajan, TechRadar Pro Article and Information Commissioner's Office (ICO) Reprimand.
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Completed (recovery phase over, but specifics of breach remain unclear).
Stakeholder and Customer Advisories
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued was an Public statements acknowledging the incident and recovery efforts.
.png)
Latest Global CVEs (Not Company-Specific)
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
- https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
- https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
- https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
- https://github.com/angular/angular/releases/tag/19.2.16
- https://github.com/angular/angular/releases/tag/20.3.14
- https://github.com/angular/angular/releases/tag/21.0.1
- https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 8.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 6.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=the-electoral-commission' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
