# cve.now: Sonatype

The newest entries naming Sonatype as an affected vendor (up to 200), of 49 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-113368](https://cve.now/CVE-2026-113368.md): Nexus Repository 3 - Group Repository Member Authorization Bypass (CVSS 5.3)
- [CVE-2026-113369](https://cve.now/CVE-2026-113369.md): Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab (CVSS 6.3)
- [CVE-2026-113370](https://cve.now/CVE-2026-113370.md): Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task (CVSS 7.7)
- [CVE-2026-113371](https://cve.now/CVE-2026-113371.md): Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase (CVSS 7.1)
- [CVE-2026-113372](https://cve.now/CVE-2026-113372.md): Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Key (CVSS 7.1)
- [CVE-2026-113373](https://cve.now/CVE-2026-113373.md): Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again (CVSS 9.1)
- [CVE-2026-113374](https://cve.now/CVE-2026-113374.md): Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation (CVSS 8.6)
- [CVE-2026-97712](https://cve.now/CVE-2026-97712.md): Nexus Repository 3 - Privilege Escalation via Role Management (CVSS 8.7)
- [CVE-2026-97667](https://cve.now/CVE-2026-97667.md): Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI (CVSS 5.1)
- [CVE-2026-97666](https://cve.now/CVE-2026-97666.md): Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint (CVSS 6.9)
- [CVE-2026-97665](https://cve.now/CVE-2026-97665.md): Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload (CVSS 7.1)
- [CVE-2026-77121](https://cve.now/CVE-2026-77121.md): Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields (CVSS 5.3)
- [CVE-2026-77122](https://cve.now/CVE-2026-77122.md): Nexus Repository 3 - Incorrect Authorization Allows Disclosure of Member Repository Metadata via Group Repository Permissions (CVSS 5.3)
- [CVE-2026-77123](https://cve.now/CVE-2026-77123.md): Nexus Repository 3 - Webhook Secret Disclosure via Capability Read API (CVSS 6.0)
- [CVE-2026-77124](https://cve.now/CVE-2026-77124.md): Nexus Repository 3 - Script Execution Disable Setting Not Enforced (CVSS 7.5)
- [CVE-2026-77125](https://cve.now/CVE-2026-77125.md): Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints (CVSS 7.1)
- [CVE-2026-14644](https://cve.now/CVE-2026-14644.md): Nexus Repository 3 - Privilege Escalation (CVSS 8.6)
- [CVE-2026-17593](https://cve.now/CVE-2026-17593.md): Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration (CVSS 7.2)
- [CVE-2026-17594](https://cve.now/CVE-2026-17594.md): Nexus Repository 3 - Authorization Bypass in Repository Creation (CVSS 8.2)
- [CVE-2026-17595](https://cve.now/CVE-2026-17595.md): Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass (CVSS 5.3)
- [CVE-2026-17596](https://cve.now/CVE-2026-17596.md): Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store Name (CVSS 6.3)
- [CVE-2026-17598](https://cve.now/CVE-2026-17598.md): Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration (CVSS 5.3)
- [CVE-2026-17599](https://cve.now/CVE-2026-17599.md): Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint (CVSS 6.9)
- [CVE-2026-17600](https://cve.now/CVE-2026-17600.md): Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation (CVSS 8.7)
- [CVE-2026-17601](https://cve.now/CVE-2026-17601.md): Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator (CVSS 8.9)
- [CVE-2026-17603](https://cve.now/CVE-2026-17603.md): Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API (CVSS 8.7)
- [CVE-2026-17597](https://cve.now/CVE-2026-17597.md): Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification (CVSS 5.1)
- [CVE-2026-14646](https://cve.now/CVE-2026-14646.md): Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect (CVSS 4.9)
- [CVE-2026-14645](https://cve.now/CVE-2026-14645.md): Nexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global Capability (CVSS 5.1)
- [CVE-2026-14504](https://cve.now/CVE-2026-14504.md): Nexus Repository 3 - Authorization Bypass in Component Upload API (CVSS 8.2)
- [CVE-2026-7494](https://cve.now/CVE-2026-7494.md): Nexus Repository - SSRF in SSL Certificate Retrieval (CVSS 5.3)
- [CVE-2026-11403](https://cve.now/CVE-2026-11403.md): Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation (CVSS 8.7)
- [CVE-2026-10741](https://cve.now/CVE-2026-10741.md): Nexus Repository Manager - Incorrect Authorization allows credential disclosure via proxy repository configuration (CVSS 5.9)
- [CVE-2026-10748](https://cve.now/CVE-2026-10748.md): Nexus Repository 3 - Remote Code Execution via License Deserialization (CVSS 8.6)
- [CVE-2026-3329](https://cve.now/CVE-2026-3329.md): Nexus Repository Manager - Improper Restriction of Excessive Authentication Attempts (CVSS 8.7)
- [CVE-2026-7308](https://cve.now/CVE-2026-7308.md): Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via HTML Browse Page (CVSS 5.1)
- [CVE-2026-3048](https://cve.now/CVE-2026-3048.md): Nexus Repository 3 - Improper LDAP Referral Handling (CVSS 5.1)
- [CVE-2026-5189](https://cve.now/CVE-2026-5189.md): Nexus Repository 3 - Hardcoded Credential in Internal Database Component (CVSS 9.2)
- [CVE-2026-3199](https://cve.now/CVE-2026-3199.md): Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection (CVSS 9.4)
- [CVE-2026-3438](https://cve.now/CVE-2026-3438.md): Nexus Repository 3 - Reflected Cross-Site Scripting (XSS) in ?describe Pages (CVSS 5.1)
- [CVE-2026-0600](https://cve.now/CVE-2026-0600.md): Nexus Repository 3 - Server-Side Request Forgery in Proxy Repository Configuration (CVSS 6.2)
- [CVE-2026-0601](https://cve.now/CVE-2026-0601.md): Nexus Repository 3 - Cross-Site Scripting (CVSS 5.1)
- [CVE-2025-13488](https://cve.now/CVE-2025-13488.md): Nexus Repository 3 - Stored Cross-Site Scripting (XSS) (CVSS 5.1)
- [CVE-2025-9868](https://cve.now/CVE-2025-9868.md): Nexus Repository 2 - SSRF Vulnerability in Remote Browser Plugin (CVSS 8.7)
- [CVE-2024-5082](https://cve.now/CVE-2024-5082.md): Nexus Repository 2 - Remote Code Execution (CVSS 7.1)
- [CVE-2024-5083](https://cve.now/CVE-2024-5083.md): Nexus Repository 2 - Stored XSS (CVSS 5.1)
- [CVE-2024-5764](https://cve.now/CVE-2024-5764.md): Nexus Repository 3 - Static hard-coded encryption passphrase used by default (CVSS 5.9)
- [CVE-2024-4956](https://cve.now/CVE-2024-4956.md): Nexus Repository 3 - Path Traversal (CVSS 7.5)
- [CVE-2024-1142](https://cve.now/CVE-2024-1142.md): Sonatype IQ Server - Path Traversal (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/sonatype
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.