What is the official website of XOOCITY Hong Kong Metaverse 数宇城香港 ?

The official website of XOOCITY Hong Kong Metaverse 数宇城香港 is http://www.xoocity.com.

What is XOOCITY Hong Kong Metaverse 数宇城香港's cybersecurity risk score?

XOOCITY Hong Kong Metaverse 数宇城香港 has an AI-generated cybersecurity risk score of 796 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has XOOCITY Hong Kong Metaverse 数宇城香港 experienced?

According to Rankiteo, XOOCITY Hong Kong Metaverse 数宇城香港 currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has XOOCITY Hong Kong Metaverse 数宇城香港 been affected by any supply chain cyber incidents ?

According to Rankiteo, XOOCITY Hong Kong Metaverse 数宇城香港 has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.

Does XOOCITY Hong Kong Metaverse 数宇城香港 have SOC 2 Type 1 certification ?

According to Rankiteo, XOOCITY Hong Kong Metaverse 数宇城香港 is not certified under SOC 2 Type 1.

Does XOOCITY Hong Kong Metaverse 数宇城香港 have SOC 2 Type 2 certification ?

According to Rankiteo, XOOCITY Hong Kong Metaverse 数宇城香港 does not hold a SOC 2 Type 2 certification.

Does XOOCITY Hong Kong Metaverse 数宇城香港 comply with GDPR ?

According to Rankiteo, XOOCITY Hong Kong Metaverse 数宇城香港 is not listed as GDPR compliant.

Does XOOCITY Hong Kong Metaverse 数宇城香港 have PCI DSS certification ?

According to Rankiteo, XOOCITY Hong Kong Metaverse 数宇城香港 does not currently maintain PCI DSS compliance.

Does XOOCITY Hong Kong Metaverse 数宇城香港 comply with HIPAA ?

According to Rankiteo, XOOCITY Hong Kong Metaverse 数宇城香港 is not compliant with HIPAA regulations.

Does XOOCITY Hong Kong Metaverse 数宇城香港 have ISO 27001 certification ?

According to Rankiteo,XOOCITY Hong Kong Metaverse 数宇城香港 is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does XOOCITY Hong Kong Metaverse 数宇城香港 operate in ?

XOOCITY Hong Kong Metaverse 数宇城香港 operates primarily in the Technology, Information and Internet industry.

How many employees does XOOCITY Hong Kong Metaverse 数宇城香港 have ?

XOOCITY Hong Kong Metaverse 数宇城香港 employs approximately 1 people worldwide.

Does XOOCITY Hong Kong Metaverse 数宇城香港 own any subsidiaries ?

XOOCITY Hong Kong Metaverse 数宇城香港 presently has no subsidiaries across any sectors.

How many LinkedIn followers does XOOCITY Hong Kong Metaverse 数宇城香港 have ?

XOOCITY Hong Kong Metaverse 数宇城香港's official LinkedIn profile has approximately followers.

What is the NAICS classification code for XOOCITY Hong Kong Metaverse 数宇城香港 ?

XOOCITY Hong Kong Metaverse 数宇城香港 is classified under the NAICS code 513, which corresponds to Others.

Does XOOCITY Hong Kong Metaverse 数宇城香港 have a Crunchbase profile ?

Yes, XOOCITY Hong Kong Metaverse 数宇城香港 has an official profile on Crunchbase, which can be accessed here: https://www.crunchbase.com/organization/xoocity.

Does XOOCITY Hong Kong Metaverse 数宇城香港 have a LinkedIn profile ?

Yes, XOOCITY Hong Kong Metaverse 数宇城香港 maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/xoocity.

How many cybersecurity incidents has XOOCITY Hong Kong Metaverse 数宇城香港 experienced ?

As of August 2, 2026, Rankiteo reports that XOOCITY Hong Kong Metaverse 数宇城香港 has not experienced any cybersecurity incidents.

How many peer or competitor companies does XOOCITY Hong Kong Metaverse 数宇城香港 have ?

XOOCITY Hong Kong Metaverse 数宇城香港 has an estimated 15,116 peer or competitor companies worldwide.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

XHKM

Boost Score +25 with badge (5 left)

796

/1000

Fair

821

/1000

Good

XOOCITY Hong Kong Metaverse 数宇城香港 Vendor Cyber Rating & Cyber Score

xoocity.com

cb in

Add Your Compliance Badge

XOOCITY is pioneering a virtual metaverse named CitiFi, designed to seamlessly integrate trade, tourism, job opportunities, and social interactions. By harnessing the power of blockchain technology and real-world assets, we have created a platform for trading virtual assets, offering services such as NFT trading, cross-border e-commerce, AI customer service, and digital payment solutions within the metaverse ecosystem. XOOCITY Hong Kong, a local Hong Kong metaverse community provides virtual land, web3 games and applications ! The XOOCITY replicates real cities to create a virtual world for visitors touring on attractions, skyscrapers, amusement parks, temples, landscapes as well as shops and trade expos. XOOCITY Members invest in our

XHKM A.I CyberSecurity Scoring

Scoring History

XHKM

XOOCITY Hong Kong Metaverse 数宇城香港 CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

No data available

Loading…

A.I.

XHKM Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for XHKM

Incidents vs Technology, Information and Internet Industry Avg (This Year)

No incidents recorded for XOOCITY Hong Kong Metaverse 数宇城香港 in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for XOOCITY Hong Kong Metaverse 数宇城香港 in 2026.

Incident Types XHKM vs Technology, Information and Internet Industry Avg (This Year)

No incidents recorded for XOOCITY Hong Kong Metaverse 数宇城香港 in 2026.

Incident History - XHKM (X = Date, Y = Severity)

Loading…

SUBSIDIARY

XOOCITY Hong Kong Metaverse 数宇城香港 Subsidiaries

XHKM

Technology, Information and Internet

Website: http://www.xoocity.com

Company Size: 1

HKSTP - Hong Kong Science and Technology Parks CorporationIT Services and IT Consulting

Fano (Fano Labs)Technology, Information and Internet

LalamoveSoftware Development

HKSTP CapitalVenture Capital and Private Equity Principals

CredoSemiconductor Manufacturing

Pantheon Lab LimitedSoftware Development

Dayta AIIT Services and IT Consulting

August RoboticsComputers and Electronics Manufacturing

Buy&ShipInternet Marketplace Platforms

CryptoBLKBlockchain Services

RaSpectSoftware Development

Insight Robotics Ltd.IT Services and IT Consulting

BioMapBiotechnology Research

HKRITA - The Hong Kong Research Institute of Textiles and Apparel LimitedResearch Services

ApoideaTechnology, Information and Media

Well Being Digital Limited (WBD101)Semiconductor Manufacturing

Singular GlobalBlockchain Services

MadheadInformation Technology & Services

Centre for Oncology and ImmunologyResearch Services

Belun Technology Company LimitedMedical Equipment Manufacturing

Blockchain Solutions LimitedIT Services and IT Consulting

CerTrazeInformation Technology & Services

Hong Kong Industrial Artificial Intelligence and Robotics Centre (FLAIR)Appliances, Electrical, and Electronics Manufacturing

HKCeND - Hong Kong Center for Neurodegenerative Diseases (香港神經退行性疾病中心)Research Services

Sycra Technologies LimitedAppliances, Electrical, and Electronics Manufacturing

FreightAmigoIT Services and IT Consulting

ClusterTech LimitedInformation Technology & Services

NovoheartBiotechnology Research

Multi-Scale Medical Robotics Center LtdMedical Equipment Manufacturing

PanopticAISoftware Development

Centre for Immunology & Infection - C2iResearch Services

SquareDog RoboticsIndustrial Automation

ArbeleBiotechnology Research

ALiA BioTechMedical Equipment Manufacturing

Integrated Solutions LimitedSoftware Development

Aura LabsIT Services and IT Consulting

Studio AOEAdvertising Services

Centre for Advances in Reliability and SafetyAppliances, Electrical, and Electronics Manufacturing

Imsight TechnologySoftware Development

Imsight – Health CornerSoftware Development

PuraPharm Corporation LimitedPharmaceutical Manufacturing

PerksBarSoftware Development

BeeInventor 點子建IT Services and IT Consulting

Profiled Group LimitedAppliances, Electrical, and Electronics Manufacturing

GoByBus.hkIT Services and IT Consulting

eNano Health LimitedBiotechnology Research

Zensis LimitedIT Services and IT Consulting

n-hop technologies LimitedTelecommunications

QBS System LimitedIT Services and IT Consulting

Datago Technology LimitedFinancial Services

uHey LimitedSpectator Sports

Homie Living | 靈感+購物香港線上家居平台Furniture and Home Furnishings Manufacturing

Life Code LimitedBiotechnology Research

Growgreen LimitedComputers and Electronics Manufacturing

2GoTradeFinancial Services

HSK GeneTech | ProbioLifeBiotechnology Research

JSAB Technologies LimitedSemiconductor Manufacturing

Sebit Company LimitedIT Services and IT Consulting

Atom Semiconductor Technologies Ltd.Semiconductors

BrainNow Medical Technology LimitedMedical Device

AppoTech LimitedSemiconductors

Hong Kong Academy of EngineeringNon-profit Organizations

The GrindTechnology, Information and Internet

Motive Force Technology LimitedSoftware Development

LaSense Technology LimitedIndustrial Machinery Manufacturing

Hessner TechnologiesResearch Services

ReflectionBio – By Patients, For PatientsBiotechnology Research

Stellerus Technology LimitedInformation Services

AppciderIT Services and IT Consulting

Add Care LimitedBiotechnology

AIVISoftware Development

Propagation Systems LimitedAppliances, Electrical, and Electronics Manufacturing

Narrative ProjectsTechnology, Information and Internet

LinkedTech Solutions LimitedInformation Technology & Services

Loading…

XOOCITY Hong Kong Metaverse 数宇城香港 Similar Companies

Personal

personal.com.ar

En Personal, ponemos a las personas en el centro. Somos el ecosistema de servicios de Telecom Argentina S.A. que conecta a cada persona con todo lo que le importa. Nuestra propuesta está pensada para que cada persona, comunidad y organización pueda avanzar, disfrutar y transformar su realidad. Brindamos más de 35 millones de servicios que acompañan a personas, hogares y empresas en cada momento de su vida. Con Personal Fibra y Personal Móvil, llevamos conexión a cada casa y a donde se necesite. Con Flow, acercamos lo mejor de la TV y el streaming. Con Personal Pay, conectamos a cada uno con su dinero de manera simple y segura. Con Personal Smarthome, transformamos el hogar en un espacio más seguro, conectado y eficiente. Con Tienda Personal, ofrecemos dispositivos y tecnología para la vida cotidiana de manera confiable y accesible. Y con Personal Tech, acompañamos a empresas y gobiernos en su transformación digital. Estamos presentes en Argentina y Paraguay, ofreciendo nuestro ecosistema completo de servicios. Además, contamos con TV paga en Uruguay y soluciones digitales en Chile. Lideramos iniciativas globales como OpenGateway y desarrollamos plataformas abiertas para que la innovación llegue a todos. Somos una compañía hecha por personas para personas. Miles de colaboradores en todo el país trabajamos cada día para impulsar la economía digital con inversión constante, prácticas sustentables e iniciativas que promueven la inclusión y el talento. Porque creemos que la tecnología sólo tiene sentido cuando está al servicio de las personas. Cada vez más Personal.

Everforth

everforth.com

Everforth, Inc. (NYSE: EFOR) is a leading technology and digital engineering company that helps organizations adapt, innovate, and thrive in a world of constant change. Our six solution areas — AI and data, cloud and infrastructure, application and digital engineering, experience, cybersecurity, and enterprise platforms — accelerate time to value for our commercial and federal clients. Powered by proprietary assets, accelerators, and proven expertise, Everforth turns complexity into progress and delivers measurable outcomes. Everforth: Adapt and Thrive™.

Swiggy

swiggy.com

Swiggy is India’s pioneering on-demand convenience platform, catering to millions of consumers each month. Founded in 2014, its mission is to elevate the quality of life for the urban consumer by offering unparalleled convenience. With an extensive footprint in food delivery, Swiggy Food collaborates with nearly 2 lakh restaurants across 600+ cities. Swiggy Instamart, its quick commerce platform operating in 120+ cities, delivers groceries and other essentials across 40+ categories in 10 minutes. Fueled by a commitment to innovation, Swiggy continually incubates and integrates new services like Swiggy Dineout and Swiggy Genie into its multi-service app. Leveraging cutting-edge technology and Swiggy One, the country’s only membership program offering benefits across food, quick commerce, dining out, and pick-up and drop services, Swiggy aims to provide a superior experience to its consumers. For more information, visit www.swiggy.com

Sohu.com

cb sohu.com

Sohu.com Inc. (NASDAQ: SOHU) is China's premier online brand and indispensable to the daily life of millions of Chinese, providing a network of web properties and community based/web 2.0 products which offer the vast Sohu user community a broad array of choices regarding information, entertainment and communication. Sohu has built one of the most comprehensive matrices of Chinese language web properties and proprietary search engines, consisting of seven leading web properties.

IndiaMART InterMESH Limited

cb indiamart.com

IndiaMART is India's largest online B2B marketplace, connecting buyers with suppliers across a wide array of industries. IndiaMART provides a platform for Small & Medium Enterprises (SMEs), large enterprises, and individual buyers, helping them access diverse portfolios of quality products. Since 1999, IndiaMART’s mission has been to make doing business easy. Today, over 21.9 Crore buyers can explore and choose from 12.4 Crore products, sourced from 86 Lakh suppliers, creating a one-stop platform for all business needs. IndiaMART offers enhanced business visibility and credibility for suppliers, with tools designed to support business growth and operational efficiency. With a dedicated workforce of over 5000 employees across India, IndiaMART continues to facilitate seamless connections and provide a trusted marketplace for businesses to thrive.

Arrow Electronics

arrow.com

Arrow Electronics (NYSE:ARW) guides innovation forward for thousands of leading technology manufacturers and service providers. With 2024 sales of $27.9 billion, Arrow develops technology solutions that help improve business and daily life. Our broad portfolio that spans the entire technology landscape, helps customers design, distribute and deploy forward-thinking products that make the benefits of technology accessible to as many people as possible. Learn more at arrow.com. Are you thinking Five Years Out? Join us at careers.arrow.com.

Meesho

meesho.io

Meesho is India’s e-commerce marketplace, on a mission to democratise internet commerce. Our multi-sided technology platform connects four key stakeholders — consumers, sellers, logistics partners, and content creators — to power inclusive growth at scale. We enable individuals and small businesses to sell online with ease, offering access to a wide customer base, integrated logistics, payment solutions, and platform support. For customers, Meesho offers a broad and affordable selection, tailored for diverse needs across Bharat. We also empower creators to build commerce-driven content that drives discovery and engagement. Our logistics operations are powered by Valmo, Meesho’s asset-light logistics platform that works entirely through partner-led infrastructure to ensure cost-efficient and scalable deliveries.

Flipkart

flipkart.com

At Flipkart, we're driven by our purpose of empowering every Indian's dream by delivering value through innovation in technology and commerce. With a customer base of over 350 million, product coverage of over 150 million across 80+ categories, a focus on generating direct and indirect employment and a commitment to empowering generations of entrepreneurs and MSMEs, all driven by a sustainable growth strategy – Flipkart is maximising for customers, stakeholders, and the planet at large! At Flipkart, our promise to every Flipster is - getting an opportunity to leave a mark and create their own legacy, the freedom to experiment, learn and grow, work with the industry’s brightest minds as part of a diverse team and we will extend our culture of care to them to ensure that they can focus on doing their best work. Driven by audacity, bias for action, customer first, integrity and inclusion – Flipsters have pioneered solutions that have transformed digital commerce in India. From the industry-first introduction of cash-on-delivery in 2010 to the launch of voice search and multiple vernacular interfaces in 2021 that have made e-commerce a very inclusive experience, Flipkart continues the exciting journey of solving for the Indian customer. We understand that your own aspirations and journeys are unique. So you choose what you want to maximise, and we provide you the platform for it - because when you maximise, we maximise. Flipkart is a part of the Walmart-owned Flipkart Group, which also includes group companies Flipkart Wholesale, Flipkart Health+, Cleartrip, and Myntra. Get in touch with our experts for support with your orders here: https://www.flipkart.com/helpcentre

Akamai Technologies

akamai.com

At Akamai, we make life better for billions of people, billions of times a day. Every day, billions of people around the world connect with their favorite brands to shop online, play the latest video games, log into mobile banking apps, learn remotely, share videos with friends, and so much more. They may not know it, but Akamai is there, powering and protecting life online. Over 20 years ago, we set out to solve the toughest challenge of the early internet: the “World Wide Wait.” And we’ve been solving the internet’s toughest challenges ever since, working toward our vision of a safer and more connected world. With the world’s most distributed compute platform — from cloud to edge — we make it easy for businesses to develop and run applications, while we keep experiences closer to users and threats farther away. That’s why innovative companies worldwide choose Akamai to build, deliver, and secure their digital experiences. Our leading security, compute, and delivery solutions are helping global companies make life better for billions of people, billions of times a day. Devoted, determined problem-solvers who share a passion for technology, we’re always pushing ground-breaking ideas and driving innovation. Want to power and protect life online, by solving the toughest challenges? Be part of an amazing team. Let’s connect: LinkedIn: https://www.linkedin.com/company/akamai-technologies Twitter: https://twitter.com/Akamai Blog: https://www.akamai.com/blog

Loading…

NEWS

XOOCITY Hong Kong Metaverse 数宇城香港 CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-18556

SUMMARY

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://uptime.n-able.com/

CVE-2026-55735

SUMMARY

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55734

SUMMARY

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55733

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-54894

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…