Sonatype Nexus vulnerabilities

• sonatype nexus repository 3 Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase CVE-2026-113371 7.1 HighNovember 4, 2026
• sonatype nexus repository 3 Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task CVE-2026-113370 7.7 HighNovember 4, 2026
• sonatype nexus repository 3 Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab CVE-2026-113369 6.3 MediumNovember 4, 2026
• sonatype nexus repository 3 Nexus Repository 3 - Group Repository Member Authorization Bypass CVE-2026-113368 5.3 MediumNovember 4, 2026
• sonatype nexus repository 3 Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation CVE-2026-113374 8.6 HighNovember 4, 2026
• sonatype nexus repository 3 Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again CVE-2026-113373 9.1 CriticalNovember 4, 2026
• sonatype nexus repository 3 Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Key CVE-2026-113372 7.1 HighNovember 4, 2026
• sonatype nexus repository 3 Nexus Repository 3 - Privilege Escalation via Role Management CVE-2026-97712 8.7 HighOctober 15, 2026
• sonatype nexus repository 3 Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI CVE-2026-97667 5.1 MediumOctober 15, 2026
• sonatype nexus repository 3 Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint CVE-2026-97666 6.9 MediumOctober 15, 2026
• sonatype nexus repository 3 Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload CVE-2026-97665 7.1 HighOctober 15, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields CVE-2026-77121 5.3 MediumSeptember 2, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints CVE-2026-77125 7.1 HighSeptember 2, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - Script Execution Disable Setting Not Enforced CVE-2026-77124 7.5 HighSeptember 2, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - Webhook Secret Disclosure via Capability Read API CVE-2026-77123 6.0 MediumSeptember 2, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - Incorrect Authorization Allows Disclosure of Member Repository Metadata via Group Repository Permissions CVE-2026-77122 5.3 MediumSeptember 2, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass CVE-2026-17595 5.3 MediumAugust 7, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - Authorization Bypass in Repository Creation CVE-2026-17594 8.2 HighAugust 7, 2026
• sonatype nexus repository, nexus repository manager +1 more Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration CVE-2026-17593 7.2 HighAugust 7, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - Privilege Escalation CVE-2026-14644 8.6 HighAugust 7, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator CVE-2026-17601 8.9 HighAugust 7, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation CVE-2026-17600 8.7 HighAugust 7, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint CVE-2026-17599 6.9 MediumAugust 7, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration CVE-2026-17598 5.3 MediumAugust 7, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store Name CVE-2026-17596 6.3 MediumAugust 7, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API CVE-2026-17603 8.7 HighAugust 7, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification CVE-2026-17597 5.1 MediumAugust 7, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect CVE-2026-14646 4.9 MediumJuly 14, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global Capability CVE-2026-14645 5.1 MediumJuly 14, 2026
• sonatype nexus repository 3, nexus repository manager +1 more Nexus Repository 3 - Authorization Bypass in Component Upload API CVE-2026-14504 8.2 HighJuly 14, 2026
• sonatype nexus repository, nexus repository manager +1 more Nexus Repository - SSRF in SSL Certificate Retrieval CVE-2026-7494 5.3 MediumJuly 14, 2026
• sonatype nexus repository manager Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation CVE-2026-11403 8.7 HighJuly 14, 2026
• sonatype nexus repository manager Nexus Repository Manager - Incorrect Authorization allows credential disclosure via proxy repository configuration CVE-2026-10741 5.9 MediumJune 17, 2026
• sonatype nexus repository, nexus repository manager +1 more Nexus Repository 3 - Remote Code Execution via License Deserialization CVE-2026-10748 8.6 HighJune 16, 2026
• sonatype nexus repository manager Nexus Repository Manager - Improper Restriction of Excessive Authentication Attempts CVE-2026-3329 8.7 HighJune 11, 2026
• sonatype nexus repository, nexus repository manager +1 more Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via HTML Browse Page CVE-2026-7308 5.1 MediumMay 11, 2026
• sonatype nexus repository, nexus repository manager +1 more Nexus Repository 3 - Improper LDAP Referral Handling CVE-2026-3048 5.1 MediumMay 11, 2026
• sonatype nexus repository, nexus repository manager +1 more Nexus Repository 3 - Hardcoded Credential in Internal Database Component CVE-2026-5189 9.2 CriticalApril 15, 2026
• sonatype nexus repository, nexus repository manager +1 more Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection CVE-2026-3199 9.4 CriticalApril 8, 2026
• sonatype nexus repository, nexus repository manager +1 more Nexus Repository 3 - Reflected Cross-Site Scripting (XSS) in ?describe Pages CVE-2026-3438 5.1 MediumApril 8, 2026
• sonatype nexus repository Nexus Repository 3 - Server-Side Request Forgery in Proxy Repository Configuration CVE-2026-0600 6.2 MediumJanuary 14, 2026
• sonatype nexus repository Nexus Repository 3 - Cross-Site Scripting CVE-2026-0601 5.1 MediumJanuary 14, 2026
• sonatype nexus repository Nexus Repository 3 - Stored Cross-Site Scripting (XSS) CVE-2025-13488 5.1 MediumDecember 4, 2025
• sonatype nexus repository Nexus Repository 2 - SSRF Vulnerability in Remote Browser Plugin CVE-2025-9868 8.7 HighOctober 8, 2025
• sonatype nexus repository Nexus Repository 2 - Remote Code Execution CVE-2024-5082 Public exploit 7.1 HighNovember 14, 2024
• sonatype nexus repository Nexus Repository 2 - Stored XSS CVE-2024-5083 Public exploit 5.1 MediumNovember 14, 2024
• sonatype nexus repository, nexus repository manager +1 more Nexus Repository 3 - Static hard-coded encryption passphrase used by default CVE-2024-5764 Public exploit 5.9 MediumOctober 23, 2024
• sonatype nexus repository Nexus Repository 3 - Path Traversal CVE-2024-4956 Public exploit EPSS 19.2% 7.5 HighMay 16, 2024
• sonatype nexus repository manager Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF. CVE-2022-27907 4.3 MediumMarch 30, 2022
• sonatype nexus repository manager Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection. CVE-2021-43961 4.3 MediumMarch 17, 2022
• Show olderLoading…