What is the official website of Vdara Hotel & Spa ?

The official website of Vdara Hotel & Spa is http://vdara.com.

What is Vdara Hotel & Spa's cybersecurity risk score?

Vdara Hotel & Spa has an AI-generated cybersecurity risk score of 847 out of 1000, indicating a Good security posture according to Rankiteo's assessment.

How many security incidents has Vdara Hotel & Spa experienced?

According to Rankiteo, Vdara Hotel & Spa currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has Vdara Hotel & Spa been affected by any supply chain cyber incidents ?

According to Rankiteo, Vdara Hotel & Spa has been affected by multiple supply chain cyber incidents. The affected supply chain sources and their corresponding incident IDs are: gastrodat GmbH (Incident ID: CHEGAS1776335039) Oracle (Incident ID: MGMCAEORAWYN1771962331) Snowflake (Incident ID: MEREQUUNIMAEMGMGOOTOYSNOALLORARIPTIC1775528897) Cresta (Incident ID: HAWQANMGM1771230438)

Does Vdara Hotel & Spa have SOC 2 Type 1 certification ?

According to Rankiteo, Vdara Hotel & Spa is not certified under SOC 2 Type 1.

Does Vdara Hotel & Spa have SOC 2 Type 2 certification ?

According to Rankiteo, Vdara Hotel & Spa does not hold a SOC 2 Type 2 certification.

Does Vdara Hotel & Spa comply with GDPR ?

According to Rankiteo, Vdara Hotel & Spa is not listed as GDPR compliant.

Does Vdara Hotel & Spa have PCI DSS certification ?

According to Rankiteo, Vdara Hotel & Spa does not currently maintain PCI DSS compliance.

Does Vdara Hotel & Spa comply with HIPAA ?

According to Rankiteo, Vdara Hotel & Spa is not compliant with HIPAA regulations.

Does Vdara Hotel & Spa have ISO 27001 certification ?

According to Rankiteo,Vdara Hotel & Spa is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does Vdara Hotel & Spa operate in ?

Vdara Hotel & Spa operates primarily in the Hospitality industry.

How many employees does Vdara Hotel & Spa have ?

Vdara Hotel & Spa employs approximately 287 people worldwide.

Does Vdara Hotel & Spa own any subsidiaries ?

Vdara Hotel & Spa presently has no subsidiaries across any sectors.

How many LinkedIn followers does Vdara Hotel & Spa have ?

Vdara Hotel & Spa's official LinkedIn profile has approximately followers.

What is the NAICS classification code for Vdara Hotel & Spa ?

Vdara Hotel & Spa is classified under the NAICS code 7211, which corresponds to Traveler Accommodation.

Does Vdara Hotel & Spa have a Crunchbase profile ?

No, Vdara Hotel & Spa does not have a profile on Crunchbase.

Does Vdara Hotel & Spa have a LinkedIn profile ?

Yes, Vdara Hotel & Spa maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/vdara-hotel-&-spa.

How many cybersecurity incidents has Vdara Hotel & Spa experienced ?

As of September 9, 2026, Rankiteo reports that Vdara Hotel & Spa has experienced 14 cybersecurity incidents.

How many peer or competitor companies does Vdara Hotel & Spa have ?

Vdara Hotel & Spa has an estimated 14,442 peer or competitor companies worldwide.

What types of cybersecurity incidents has Vdara Hotel & Spa faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Breach, Ransomware and Cyber Attack.

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

VHS

Boost Score +25 with badge (5 left)

847

/1000

Good

872

/1000

Very Good

Vdara Hotel & Spa Vendor Cyber Rating & Cyber Score

vdara.com

Add Your Compliance Badge

For your upcoming business travel to Las Vegas, Vdara Hotel & Spa allows you to Do Vegas Differently! Vdara is an all-suite, non-gaming, smoke-free, eco-friendly retreat conveniently located between ARIA Resort & Casino and Bellagio, and a proud recipient of the AAA Four Diamond and Forbes Four-Star Awards. Vdara offers a relaxing, comfortable and convenient escape that is perfect for any business traveler, with a wealth of amenities to make your stay complete and productive. Either before your workday starts or after it ends, Vdara offers so much more. Your stay includes access to ESPA at Vdara, our naturally-lit fitness center, plus the secluded & cozy Pool & Lounge Vdara. A bevy of dining options are also available to complete

VHS

Vdara Hotel & Spa CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

MGM Resorts Interna...

Breach

4/2026

gastrodat GmbH

CHEGAS177633503...

MGM Resorts Interna...

Cyber Attack

2/2026

Oracle

MGMCAEORAWYN177...

MGM Resorts Interna...

Ransomware

100

12/2025

Snowflake

MEREQUUNIMAEMGM...

Vdara Hotel & Spa

Ransomware

100

8/2025

MGM301080925

Vdara Hotel & Spa

Cyber Attack

100

7/2025

MGM344072525

MGM Resorts Interna...

Cyber Attack

7/2025

Cresta

HAWQANMGM177123...

Vdara Hotel & Spa

Ransomware

100

6/2025

MGM611060625

MGM Resorts Interna...

Cyber Attack

100

6/2024

MGM1776687917

Vdara Hotel & Spa

Cyber Attack

09/2023

MGM85317923

Vdara Hotel & Spa

Ransomware

100

6/2023

MGM326213211032...

Vdara Hotel & Spa

Cyber Attack

100

6/2022

MGM006210009252...

Vdara Hotel & Spa

Breach

5/2022

MGM851072625

MGM Resorts Interna...

Breach

9/2021

MGMMAIRIOCAE177...

MGM Resorts Interna...

Ransomware

100

7/2019

MGM1776443945

Loading…

A.I.

VHS Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for VHS

Incidents vs Hospitality Industry Avg (This Year)

No incidents recorded for Vdara Hotel & Spa in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for Vdara Hotel & Spa in 2026.

Incident Types VHS vs Hospitality Industry Avg (This Year)

No incidents recorded for Vdara Hotel & Spa in 2026.

Incident History - VHS (X = Date, Y = Severity)

Loading…

SUBSIDIARY

Vdara Hotel & Spa Subsidiaries

VHS

Hospitality

Website: http://vdara.com

Company Size: 287

MGM Resorts InternationalHospitality

Loading…

Vdara Hotel & Spa Similar Companies

ITC Hotels Limited

itchotels.com

Established in 1975, ITC Hotels Limited has grown to encompass over 140+ hotels across 90+ destinations, solidifying its presence in the Indian subcontinent ITC Hotels seamlessly blends India’s rich tradition of hospitality with globally benchmarked services, offering a collection of hotels and resorts that reflect the unique culture and ethos of each destination. The group operates under six vibrant brands: ITC Hotels and Mementos in the luxury segment, Storii in the boutique premium segment, Welcomhotel in the upper upscale category, Fortune in the midscale segment, and WelcomHeritage in the heritage leisure space

Meliá Hotels International

ow.ly

Welcome to Meliá Hotels International! From Mallorca to the world, our story is an exciting journey that began more than six decades ago and has led us to become one of the largest hotel chains on the planet and the most sustainable in Europe (S&P Global). With more than 400 hotels across the world, our passion for hospitality drives us to deliver unique and memorable experiences through our nine brands: Gran Meliá Hotels & Resorts, ME by Meliá, The Meliá Collection, Paradisus by Meliá, Meliá Hotels & Resorts, ZEL, INNSiDE by Meliá, Sol by Meliá and Affiliated by Meliá. If you are looking for a place where your talent can shine and contribute to a more sustainable future, Meliá Hotels International is your destination. We are a family of more than 45,000 people, where every one of us is a VIP (Very Inspiring People) and we are proud to be a Top Employer in multiple countries. Being part of Meliá is to undertake a journey without borders, because the possibilities for development and learning are endless. Here, we enjoy a passionate and familiar environment, full of opportunities where inspiration will always be with you. Join us and feel like a true VIP!

Radisson Hotel Group

radissonhotels.com

Radisson Hotel Group is an international hotel group, operating in EMEA and APAC with over 1,320 hotels in operation and under development in +95 countries. The international hotel group is rapidly expanding with a plan to significantly grow the portfolio. The Group’s overarching brand promise is Every Moment Matters with a signature Yes I Can! service ethos. The Radisson family of brands portfolio includes Radisson Collection, art’otel, Radisson Blu, Radisson, Radisson RED, Radisson Individuals, Park Plaza, Park Inn by Radisson, Country Inn & Suites by Radisson, and prizeotel brought together under one commercial umbrella brand Radisson Hotels. Radisson Rewards is Radisson Hotel Group’s loyalty program, which delivers an elevated experience that makes Every Moment Matter. As the most streamlined program in the sector, members enjoy exceptional advantages and can access their benefits from day one across a wide range of hotels in Europe, Middle East, Africa, and Asia Pacific. Radisson Meetings provides tailored solutions for any event or meeting, including hybrid solutions placing guests and their needs at the heart of its offer. Radisson Meetings is built around three strong service commitments: Personal, Professional and Memorable, while delivering on the brilliant basics and being uniquely 100% Carbon Neutral. At Radisson Hotel Group we care for people, communities and planet and aim to be Net Zero by 2050 based on the approved near-term Science Based Targets. With unique solutions such as 100% carbon neutral Radisson Meetings, we make sustainable hotel stays easy. To facilitate sustainable travel choices, all our hotels are becoming verified on Hotel Sustainability Basics.

JW Marriott

jwmarriott.com

No loud pretense. No excess formalities. Just understated elegance you’ll feel the moment you walk into one of over 80 worldwide destinations. JW Marriott is part of Marriott International’s luxury portfolio and consists of beautiful properties in gateway cities and distinctive resort locations in 28 countries around the world. These elegant hotels cater to today’s sophisticated, self-assured travelers, offering them the quiet luxury they seek in a warmly authentic, relaxed atmosphere lacking in pretense. JW Marriott properties artfully provide highly crafted, anticipatory experiences that are reflective of their locale so that their guests have the time to focus on what is most important to them.

TUI

tuigroup.com

We’re adventure seekers. Smile givers. Impact makers. We believe in the power of travel. It broadens horizons for our customers, and for our people too. New places to live, new roles to explore, new communities to join. It’s yours for the taking. We’re TUI, a leading global travel and leisure experience company that makes holiday dreams come true for people around the world. We are one of the world’s leading tourism groups counting 1200 travel agencies and online portals, five airlines with around 130 aircraft, over 400 hotels, 16 cruise liners, digital platforms for tours and activities and most importantly over 60 000 colleagues around the world. What unites us is creating moments that enrich the lives of our 21 million customers. Beside the unforgettable experience we provide our customers, we also believe in the good that tourism can bring and we care deeply about our environmental impact. The TUI Care foundation has projects in over 30 countries worldwide, building on the potential of tourism as a global force for development. The Foundation opens up new perspectives through education and training, empowers local communities to benefit from the success of tourism and engages in the protection of nature and the environment. At TUI we simply say “Let’s TUI it”. For us, that means creating happiness. Tackling challenges every day together, with a positive, can-do attitude, and finding solutions even for the most unexpected situations. Our teams across TUI are just as diverse as our destinations. So whether you have lots of experience or none at all. If you want to work in an office or feel best in the field. No matter if you’re an accomplished tech whizz, an aspiring entertainer, or simply in love with flying. There’s a place for you here.

Holiday Inn Express

holidayinnexpress.com

An IHG hotel. IHG Hotels & Resorts [LON:IHG, NYSE:IHG (ADRs)] is a global hospitality company, with a purpose to provide True Hospitality for Good. At Holiday Inn Express, we strive to make every interaction you have with us simple, smart and refreshingly engaging. With over 3,000 hotels in 75 different countries, Holiday Inn Express is IHG’s largest brand and one of the fastest growing hotel brands in the industry. Holiday Inn Express offers affordable hotels, high speed internet access, free breakfast and a comfortable room that will leave you relaxed and recharged. InterContinental Hotels Group PLC is the Group’s holding company and is incorporated in Great Britain and registered in England and Wales. Approximately 350,000 people work across IHG's hotels and corporate offices globally. Visit https://www.ihg.com/holidayinnexpress/hotels/us/en/reservation for hotel information and reservations and www.ihgrewards.com for more on IHG One Rewards. For our latest news, follow us on LinkedIn, Facebook, Instagram, TikTok and Twitter.

MGM Resorts International

cb mgmresorts.com

The resorts and casinos of MGM Resorts International™ are some of the most famous in the world. Our 28 destinations are renowned for their winning combination of quality entertainment, luxurious facilities, and exceptional customer service. We are actively expanding our presence globally, with potential developments in a number of domestic and international markets. At MGM Resorts International, we are all striving together to deliver an enticing blend of entertainment to every corner of the world. Many of our resorts are located in Las Vegas. Las Vegas features three of the largest convention centers in the U.S., spectacular entertainment, attractions, shopping, and world-famous resorts. Whether dancing fountains, incredible stage productions, casino action, museums or natural attractions such as Lake Mead, Vegas offers something for everyone. A stroll down our streets takes you around the globe, with recreations like climbing to the top of the Eiffel Tower or taking a Venetian gondola ride. From shimmering resort pools and spa rejuvenation to nonstop nightlife, Las Vegas promises an unforgettable career destination. With all of our unique and spectacular resorts and casinos, MGM Resorts International has a world of opportunities for you to discover excitement and rewards as you provide our guests with a wonderful and memorable experience. Take a closer look at our properties. We think you'll find an opportunity that's right for you. The 81,000 global employees of MGM Resorts are proud to be recognized as one of FORTUNE® Magazine’s World’s Most Admired Companies®.

Four Seasons Hotels and Resorts

cb fourseasons.com

Four Seasons Hotels and Resorts opened its first hotel in 1961, and since that time has been dedicated to perfecting the travel experience through continual innovation and the highest standards of hospitality. Currently operating more than 130 hotels and resorts, and more than 55 residential properties in major city centers and resort destinations in 47 countries, and with more than 50 projects under planning or development, Four Seasons consistently ranks among the world's best hotels and most prestigious brands in reader polls, traveler reviews and industry awards. To learn more about our career opportunities, visit fourseasons.com/careers. For more information and reservations, visit fourseasons.com. For the latest news, visit press.fourseasons.com.

Landry's

landrysinc.com

Landry's is a multinational, diversified restaurant, hospitality, gaming, and entertainment leader based in Houston, Texas. The company operates more than 600 establishments around the world, including well-known concepts, such as Landry’s Seafood House, Bubba Gump Shrimp Co., Rainforest Cafe, Morton’s The Steakhouse, The Oceanaire Seafood Room, McCormick & Schmick’s, Chart House, Saltgrass Steak House, Del Frisco’s Double Eagle Steakhouse, Palm Restaurants, and Mastro’s Restaurants. The company also operates a group of signature restaurants, including Vic & Anthony’s Steakhouse, Grotto, Willie G’s, and others. The gaming division includes the renowned Golden Nugget Hotel and Casino concept, with locations in Las Vegas and Laughlin, NV, Atlantic City, NJ, Biloxi, MS, and Lake Charles, LA. The entertainment and hospitality divisions encompass popular destinations, including the Galveston Island Historic Pleasure Pier, Kemah Boardwalk, Aquarium Restaurants, and other exciting attractions, coupled with deluxe accommodations throughout the Houston and Galveston area, including The Post Oak Hotel at Uptown Houston, Westin Houston Downtown, Kemah Boardwalk Inn and The San Luis Resort, including the Hilton Galveston Island Resort and Holiday Inn Galveston on the Beach located on Galveston Island.

Loading…

NEWS

Vdara Hotel & Spa CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

December 12, 2025 03:46 PM

MGM Resorts International appoints Ayesha Molino COO

Gaming and entertainment company MGM Resorts International (NYSE:MGM) announced on Thursday the appointment of Ayesha Molino as COO, effective January 1,...

Read Article

December 03, 2025 08:00 AM

Realty Income invests $800M in 2 Las Vegas resorts

The perpetual preferred equity investment in Aria Resort & Casino and Vdara Hotel & Spa builds on the firm's relationship with owner...

Read Article

December 03, 2025 08:00 AM

News | Investment helps Blackstone secure $3.15 billion Las Vegas casino refinancing

Realty Income has agreed to make an $800 million preferred equity investment in Blackstone's Aria Resort & Casino and Vdara Hotel & Spa,...

Read Article

December 02, 2025 08:00 AM

Blackstone Secures $800M Investment From Realty Income Corp. for Las Vegas Portfolio

The preferred equity infusion carves out a stack for the REIT to owner part of of Aria Resort Casino and Vdara Hotel Spa in Las Vegas.

Read Article

December 01, 2025 08:00 AM

Blackstone sells $800M stake in Strip casino, hotel

City Center, home to Aria casino and Vdara hotel, is getting a significant financial boost that underscores the Strip's ongoing appeal to...

Read Article

December 01, 2025 08:00 AM

Blackstone Sells $800 Million Stake in Las Vegas Strip Resorts

Blackstone Inc. is selling a preferred equity stake in the CityCenter Las Vegas complex to Realty Income Corp. in a deal that lets the...

Read Article

October 10, 2025 07:00 AM

MGM Resorts Names Four New General Managers for Five Las Vegas Resorts

We got our hands on an internal MGM Resorts communication revealing the company has named four General Managers for five of its Las Vegas...

Read Article

September 22, 2025 07:00 AM

Las Vegas goes all-in with huge sale on hotels, dining, and more

Las Vegas just launched a massive sale with discounts up to 50% on hotel rooms, food, drinks and even wedding packages to get travelers back...

Read Article

September 19, 2025 07:00 AM

Ayesha Molino has been appointed Chief Operating Officer (COO) at MGM Resorts International

MGM Resorts International (NYSE: MGM) announced today the appointment of Ayesha Molino as Chief Operating Officer.

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-86564

SUMMARY

A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: 3.3)

cvss3

Base Score: 3.3

Complexity: LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Impact Score

1.4

Exploitability

1.8

REFERENCES

CVE-2026-55250

SUMMARY

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low cache memory that causes premature eviction to free up memory and applications running macropay-solutions/maravel-framework that utilize tymon/jwt-auth for API token authentication and blacklist management or any other package that does the same may be affected. This architectural risk might also impact native Laravel applications utilizing cache tags under specific volatile or eviction-capped environments. tymon/jwt-auth automatically probes for cache tag support. If found, it forcefully wraps 14-day token blacklist entries (jti) inside a relational tymon.jwt tag. In environments where the O(1) Atomic Lazy Eviction model is active — either natively inside Maravel-Framework v20.x or manually backported into v10.x via the explicit DI container singletons provided in PR #104 (App\Cache\TaggedCache and App\Cache\TagSet) — a strict global tracking ceiling (Container::TAGGED_CACHE_TTL_CAP_SECONDS) of 7,200 seconds (2 hours) is enforced to secure the system against memory index bloat. This ceiling forcefully truncates the 14-day blacklist lifespan down to a maximum of 2 hours, after which individual tracking keys naturally expire and disappear from the active cache window. Furthermore, because the optimized engine implements a generational version matrix to achieve O(1) flush speeds, any programmatic or manual invocation of a tag flush or reset (e.g., Cache::tags([...])->flush()) instantly bumps the internal atomic master version pointer. This shifts the computed cryptographic composite hash (sha1($this->tags->getNamespace())) for all overlapping components, rendering the entire existing index immediately unreachable. Consequently, through either natural 2-hour expiration or an intervening tag flush execution (like the cache naturally cleaning old values to free up memory), the invalidation state records are entirely wiped out. Because the tokens' physical cryptographic signatures remain structurally valid for up to 14 days, stolen, hijacked, or legitimately logged-out tokens are instantly and silently resurrected across the entire API gateway, leaving the application critically vulnerable to widespread Token Replay Attacks. Because this issue is caused by an upstream architectural assumption within the tymon/jwt-auth package rather than a core defect inside the framework, there is no direct framework version upgrade that can safely bypass this lifecycle collision without breaking business cache recycling bounds. Maravel version 10.74.0 introduced a way to backport the new fixed tagged cache from 20.x into 10.x by resolving TagSet and TaggedCache from DI, which is how this latent architectural lifecycle vulnerability was discovered. Users must apply the decoupled configuration workaround outlined below. As a workaround, make sure that cache memory size does not generate early natural evictions from cache to free up space, deleting blacklisted jwt ids before they expire. Applications must decouple flat authentication vectors from the relational tagging subsystem. This forces token identifiers to write directly to the primary cache keyspace as flat, un-tagged key-value pairs where they securely retain their unclipped 14-day lifecycle.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: )

cvss4

Base Score: 8.7

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-53639

SUMMARY

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the `GET /api/v2/shop/payment-requests/{hash}` and `PUT /api/v2/shop/payment-requests/{hash}` endpoints look up the payment request solely by the hash from the URL. No ownership check is performed against the authenticated customer or the underlying order. An attacker who obtains a payment request hash can read the payment request and, through the `payment` IRI in the response, recover the underlying order's `tokenValue` (which itself grants access to the full order, items, addresses, customer email, totals); and/or update the payment request payload (e.g. `target_path`, `after_path`). These fields are used by the front-end controller to redirect the user after the payment, so an attacker can flip them to an attacker-controlled URL and intercept the buyer. The hash is a UUID, so it has to be obtained out-of-band (logs, shared links, referrer headers, a co-located client), but once it is known no other credential is required, neither authentication nor knowledge of the order token. The creation endpoint `POST /api/v2/shop/orders/{tokenValue}/payment-requests` shares the same flaw: it resolves the target order solely from the `tokenValue` in the URL without verifying that the caller owns the order. The issue is fixed in versions 2.0.18, 2.1.15, and 2.2.6. As a workaround, add a query extension that filters the `GET` operation; decorate the `PUT` state provider, guard the `POST` creation endpoint with a command-bus middleware, and wire the services.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: )

cvss4

Base Score: 6.3

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://github.com/Sylius/Sylius/security/advisories/GHSA-mr9r-h354-966r

CVE-2026-53638

SUMMARY

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass vulnerability exists in the shop account API. The `PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}` endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid (state `STATE_NEW`), does not validate that the chosen payment method is enabled for the order's channel. The equivalent checkout endpoint (`PATCH /api/v2/shop/orders/{tokenValue}/payments/{paymentId}`) correctly rejects out-of-channel payment methods with `HTTP 422`; the account endpoint silently accepts them and returns `HTTP 200`. An authenticated customer can therefore assign any globally enabled payment method to their own placed order, including methods that the store operator has explicitly excluded from that channel. The issue is fixed in versions: 2.0.18, 2.1.15, 2.2.6 and above. As a workaround, decorate the `Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface` service in the application.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: 4.3)

cvss3

Base Score: 4.3

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Impact Score

1.4

Exploitability

2.8

REFERENCES

https://github.com/Sylius/Sylius/security/advisories/GHSA-6955-hrm5-c4qp

CVE-2026-53637

SUMMARY

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart `FormComponent`. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched `FormComponent` into the application's `src/` directory and override the `sylius_shop.twig.component.cart.form` service definition to use that class.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: 6.5)

cvss3

Base Score: 6.5

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Impact Score

3.6

Exploitability

2.8

REFERENCES

https://github.com/Sylius/Sylius/security/advisories/GHSA-5597-7rmh-97q5

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…

Badge your company to reduce your risk score and your cyber insurance costs!

Trusted by insurers. Chosen by leaders.

Vdara Hotel & Spa Vendor Cyber Rating & Cyber Score

VHS A.I CyberSecurity Scoring

Vdara Hotel & Spa CyberSecurity News & History

VHS Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Incident Predictions locked

A.I Risk Score Likelihood 3 - 6 - 9 months

A.I. Risk Score Predictions locked

Underwriter Stats for VHS

Incidents vs Hospitality Industry Avg (This Year)

Incidents vs All-Companies Average (This Year)

Incident Types VHS vs Hospitality Industry Avg (This Year)

Incident History - VHS (X = Date, Y = Severity)

Vdara Hotel & Spa Subsidiaries

VHS

Vdara Hotel & Spa Similar Companies

ITC Hotels Limited

Meliá Hotels International

Radisson Hotel Group

JW Marriott

TUI

Holiday Inn Express

MGM Resorts International

Four Seasons Hotels and Resorts

Landry's

Vdara Hotel & Spa CyberSecurity News

MGM Resorts International appoints Ayesha Molino COO

Realty Income invests $800M in 2 Las Vegas resorts

News | Investment helps Blackstone secure $3.15 billion Las Vegas casino refinancing

Blackstone Secures $800M Investment From Realty Income Corp. for Las Vegas Portfolio

Blackstone sells $800M stake in Strip casino, hotel

Blackstone Sells $800 Million Stake in Las Vegas Strip Resorts

MGM Resorts Names Four New General Managers for Five Las Vegas Resorts

Las Vegas goes all-in with huge sale on hotels, dining, and more

Ayesha Molino has been appointed Chief Operating Officer (COO) at MGM Resorts International

Global CVEs (Not Company-Specific)

Access Data Using Our API

What Do We Measure ?

These are some of the factors we use to calculate the overall score:

Rankiteo

Vdara Hotel & Spa CyberSecurity News & History

VHS Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Incident Predictions locked

A.I Risk Score Likelihood 3 - 6 - 9 months

A.I. Risk Score Predictions locked

Underwriter Stats for VHS

Incidents vs Hospitality Industry Avg (This Year)

Incidents vs All-Companies Average (This Year)

Incident Types VHS vs Hospitality Industry Avg (This Year)

Incident History - VHS (X = Date, Y = Severity)

Vdara Hotel & Spa Subsidiaries

VHS

Vdara Hotel & Spa Similar Companies

ITC Hotels Limited

Meliá Hotels International

Radisson Hotel Group

JW Marriott

TUI

Holiday Inn Express

MGM Resorts International

Four Seasons Hotels and Resorts

Landry's

Vdara Hotel & Spa CyberSecurity News

MGM Resorts International appoints Ayesha Molino COO

Realty Income invests $800M in 2 Las Vegas resorts

News | Investment helps Blackstone secure $3.15 billion Las Vegas casino refinancing

Blackstone Secures $800M Investment From Realty Income Corp. for Las Vegas Portfolio

Blackstone sells $800M stake in Strip casino, hotel

Blackstone Sells $800 Million Stake in Las Vegas Strip Resorts

MGM Resorts Names Four New General Managers for Five Las Vegas Resorts

Las Vegas goes all-in with huge sale on hotels, dining, and more

Ayesha Molino has been appointed Chief Operating Officer (COO) at MGM Resorts International

Global CVEs (Not Company-Specific)

Access Data Using Our API

What Do We Measure ?

These are some of the factors we use to calculate the overall score:

Rankiteo