Sonatype vulnerabilities
49 CVEs and advisories name Sonatype as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-113368Nexus Repository 3 - Group Repository Member Authorization Bypass
- CVE-2026-113369Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab
- CVE-2026-113370Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task
- CVE-2026-113371Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase
- CVE-2026-113372Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Key
- CVE-2026-113373Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again
- CVE-2026-113374Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation
- CVE-2026-97712Nexus Repository 3 - Privilege Escalation via Role Management
- CVE-2026-97667Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI
- CVE-2026-97666Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint
- CVE-2026-97665Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload
- CVE-2026-77121Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields
- CVE-2026-77122Nexus Repository 3 - Incorrect Authorization Allows Disclosure of Member Repository Metadata via Group Repository Permissions
- CVE-2026-77123Nexus Repository 3 - Webhook Secret Disclosure via Capability Read API
- CVE-2026-77124Nexus Repository 3 - Script Execution Disable Setting Not Enforced
- CVE-2026-77125Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints
- CVE-2026-14644Nexus Repository 3 - Privilege Escalation
- CVE-2026-17593Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration
- CVE-2026-17594Nexus Repository 3 - Authorization Bypass in Repository Creation
- CVE-2026-17595Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass
- CVE-2026-17596Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store Name
- CVE-2026-17598Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration
- CVE-2026-17599Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint
- CVE-2026-17600Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation
- CVE-2026-17601Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator
- CVE-2026-17603Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API
- CVE-2026-17597Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification
- CVE-2026-14646Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect
- CVE-2026-14645Nexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global Capability
- CVE-2026-14504Nexus Repository 3 - Authorization Bypass in Component Upload API