Sonatype vulnerabilities
49 CVEs and advisories name Sonatype as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-7494Nexus Repository - SSRF in SSL Certificate Retrieval
- CVE-2026-11403Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation
- CVE-2026-10741Nexus Repository Manager - Incorrect Authorization allows credential disclosure via proxy repository configuration
- CVE-2026-10748Nexus Repository 3 - Remote Code Execution via License Deserialization
- CVE-2026-3329Nexus Repository Manager - Improper Restriction of Excessive Authentication Attempts
- CVE-2026-7308Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via HTML Browse Page
- CVE-2026-3048Nexus Repository 3 - Improper LDAP Referral Handling
- CVE-2026-5189Nexus Repository 3 - Hardcoded Credential in Internal Database Component
- CVE-2026-3199Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection
- CVE-2026-3438Nexus Repository 3 - Reflected Cross-Site Scripting (XSS) in ?describe Pages
- CVE-2026-0600Nexus Repository 3 - Server-Side Request Forgery in Proxy Repository Configuration
- CVE-2026-0601Nexus Repository 3 - Cross-Site Scripting
- CVE-2025-13488Nexus Repository 3 - Stored Cross-Site Scripting (XSS)
- CVE-2025-9868Nexus Repository 2 - SSRF Vulnerability in Remote Browser Plugin
- CVE-2024-5082Nexus Repository 2 - Remote Code Execution
- CVE-2024-5083Nexus Repository 2 - Stored XSS
- CVE-2024-5764Nexus Repository 3 - Static hard-coded encryption passphrase used by default
- CVE-2024-4956Nexus Repository 3 - Path Traversal
- CVE-2024-1142Sonatype IQ Server - Path Traversal