# Sonatype Nexus Repository 3.

Every CVE that names Sonatype Nexus Repository 3 among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Nexus Repository 3 - Group Repository Member Authorization Bypass](https://agentprime.io/advisories/CVE-2026-113368.md)
  `CVE-2026-113368` · CVE record: Sonatype Nexus Repository 3 · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab](https://agentprime.io/advisories/CVE-2026-113369.md)
  `CVE-2026-113369` · CVE record: Sonatype Nexus Repository 3 · CVSS 6.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task](https://agentprime.io/advisories/CVE-2026-113370.md)
  `CVE-2026-113370` · CVE record: Sonatype Nexus Repository 3 · CVSS 7.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: SQL injection
- [Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase](https://agentprime.io/advisories/CVE-2026-113371.md)
  `CVE-2026-113371` · CVE record: Sonatype Nexus Repository 3 · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Hard-coded credentials
- [Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Key](https://agentprime.io/advisories/CVE-2026-113372.md)
  `CVE-2026-113372` · CVE record: Sonatype Nexus Repository 3 · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Hard-coded credentials
- [Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again](https://agentprime.io/advisories/CVE-2026-113373.md)
  `CVE-2026-113373` · CVE record: Sonatype Nexus Repository 3 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation](https://agentprime.io/advisories/CVE-2026-113374.md)
  `CVE-2026-113374` · CVE record: Sonatype Nexus Repository 3 · CVSS 8.6 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Nexus Repository 3 - Privilege Escalation via Role Management](https://agentprime.io/advisories/CVE-2026-97712.md)
  `CVE-2026-97712` · CVE record: Sonatype Nexus Repository 3 · CVSS 8.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI](https://agentprime.io/advisories/CVE-2026-97667.md)
  `CVE-2026-97667` · CVE record: Sonatype Nexus Repository 3 · CVSS 5.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint](https://agentprime.io/advisories/CVE-2026-97666.md)
  `CVE-2026-97666` · CVE record: Sonatype Nexus Repository 3 · CVSS 6.9 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Code injection
- [Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload](https://agentprime.io/advisories/CVE-2026-97665.md)
  `CVE-2026-97665` · CVE record: Sonatype Nexus Repository 3 · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields](https://agentprime.io/advisories/CVE-2026-77121.md)
  `CVE-2026-77121` · CVE record: Sonatype Nexus Repository 3 · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service
- [Nexus Repository 3 - Incorrect Authorization Allows Disclosure of Member Repository Metadata via Group Repository Permissions](https://agentprime.io/advisories/CVE-2026-77122.md)
  `CVE-2026-77122` · CVE record: Sonatype Nexus Repository 3 · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control
- [Nexus Repository 3 - Webhook Secret Disclosure via Capability Read API](https://agentprime.io/advisories/CVE-2026-77123.md)
  `CVE-2026-77123` · CVE record: Sonatype Nexus Repository 3 · CVSS 6.0 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Information disclosure
- [Nexus Repository 3 - Script Execution Disable Setting Not Enforced](https://agentprime.io/advisories/CVE-2026-77124.md)
  `CVE-2026-77124` · CVE record: Sonatype Nexus Repository 3 · CVSS 7.5 High · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-184
- [Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints](https://agentprime.io/advisories/CVE-2026-77125.md)
  `CVE-2026-77125` · CVE record: Sonatype Nexus Repository 3 · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control
- [Nexus Repository 3 - Privilege Escalation](https://agentprime.io/advisories/CVE-2026-14644.md)
  `CVE-2026-14644` · CVE record: Sonatype Nexus Repository 3 · CVSS 8.6 High · Not analysed yet · Published 7 Aug 2026 · Tags: Memory corruption
- [Nexus Repository 3 - Authorization Bypass in Repository Creation](https://agentprime.io/advisories/CVE-2026-17594.md)
  `CVE-2026-17594` · CVE record: Sonatype Nexus Repository 3 · CVSS 8.2 High · Not analysed yet · Published 7 Aug 2026 · Tags: Broken access control
- [Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass](https://agentprime.io/advisories/CVE-2026-17595.md)
  `CVE-2026-17595` · CVE record: Sonatype Nexus Repository 3 · CVSS 5.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Information disclosure
- [Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store Name](https://agentprime.io/advisories/CVE-2026-17596.md)
  `CVE-2026-17596` · CVE record: Sonatype Nexus Repository 3 · CVSS 6.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration](https://agentprime.io/advisories/CVE-2026-17598.md)
  `CVE-2026-17598` · CVE record: Sonatype Nexus Repository 3 · CVSS 5.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Broken access control
- [Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint](https://agentprime.io/advisories/CVE-2026-17599.md)
  `CVE-2026-17599` · CVE record: Sonatype Nexus Repository 3 · CVSS 6.9 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: CWE-620
- [Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation](https://agentprime.io/advisories/CVE-2026-17600.md)
  `CVE-2026-17600` · CVE record: Sonatype Nexus Repository 3 and 1 more · CVSS 8.7 High · Not analysed yet · Published 7 Aug 2026 · Tags: Authentication bypass
- [Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator](https://agentprime.io/advisories/CVE-2026-17601.md)
  `CVE-2026-17601` · CVE record: Sonatype Nexus Repository 3 · CVSS 8.9 High · Not analysed yet · Published 7 Aug 2026 · Tags: Broken access control
- [Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API](https://agentprime.io/advisories/CVE-2026-17603.md)
  `CVE-2026-17603` · CVE record: Sonatype Nexus Repository 3 · CVSS 8.7 High · Not analysed yet · Published 7 Aug 2026 · Tags: Code injection
- [Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification](https://agentprime.io/advisories/CVE-2026-17597.md)
  `CVE-2026-17597` · CVE record: Sonatype Nexus Repository 3 · CVSS 5.1 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect](https://agentprime.io/advisories/CVE-2026-14646.md)
  `CVE-2026-14646` · CVE record: Sonatype Nexus Repository 3 · CVSS 4.9 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Server-side request forgery (SSRF)
- [Nexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global Capability](https://agentprime.io/advisories/CVE-2026-14645.md)
  `CVE-2026-14645` · CVE record: Sonatype Nexus Repository 3 · CVSS 5.1 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Server-side request forgery (SSRF)
- [Nexus Repository 3 - Authorization Bypass in Component Upload API](https://agentprime.io/advisories/CVE-2026-14504.md)
  `CVE-2026-14504` · CVE record: Sonatype Nexus Repository 3 · CVSS 8.2 High · Not analysed yet · Published 14 Jul 2026 · Tags: Broken access control

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=sonatype-nexus-repository-3>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/sonatype-nexus-repository-3/>. Everything for agents: <https://agentprime.io/llms.txt>.