Advisories · Technology

Sonatype Nexus Repository.

Every CVE that names Sonatype Nexus Repository among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-17593 CVE record

CVSS 7.2 High

Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration
- Sonatype Nexus Repository
- Code injection
Not analysed yet 7 Aug 2026
CVE-2026-7494 CVE record

CVSS 5.3 Medium

Nexus Repository - SSRF in SSL Certificate Retrieval
- Sonatype Nexus Repository
- Server-side request forgery (SSRF)
Not analysed yet 14 Jul 2026
CVE-2026-10748 CVE record

CVSS 8.6 High

Nexus Repository 3 - Remote Code Execution via License Deserialization
- Sonatype Nexus Repository
- Insecure deserialization
Not analysed yet 16 Jun 2026
CVE-2026-7308 CVE record

CVSS 5.1 Medium

Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via HTML Browse Page
- Sonatype Nexus Repository
- Cross-site scripting (XSS)
Not analysed yet 11 May 2026
CVE-2026-3048 CVE record

CVSS 5.1 Medium

Nexus Repository 3 - Improper LDAP Referral Handling
- Sonatype Nexus Repository
- Insecure deserialization
- Server-side request forgery (SSRF)
Not analysed yet 11 May 2026
CVE-2026-5189 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Nexus Repository 3 - Hardcoded Credential in Internal Database Component
- Sonatype Nexus Repository
- Hard-coded credentials
Not analysed yet 15 Apr 2026
CVE-2026-3199 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection
- Sonatype Nexus Repository
- Insecure deserialization
Not analysed yet 8 Apr 2026
CVE-2026-3438 CVE record

CVSS 5.1 Medium

Nexus Repository 3 - Reflected Cross-Site Scripting (XSS) in ?describe Pages
- Sonatype Nexus Repository
- Cross-site scripting (XSS)
Not analysed yet 8 Apr 2026
CVE-2026-0600 CVE record

CVSS 6.2 Medium

Nexus Repository 3 - Server-Side Request Forgery in Proxy Repository Configuration
- Sonatype Nexus Repository
- Server-side request forgery (SSRF)
Not analysed yet 14 Jan 2026
CVE-2026-0601 CVE record

CVSS 5.1 Medium

Nexus Repository 3 - Cross-Site Scripting
- Sonatype Nexus Repository
- Cross-site scripting (XSS)
Not analysed yet 14 Jan 2026
CVE-2025-13488 CVE record

CVSS 5.1 Medium

Nexus Repository 3 - Stored Cross-Site Scripting (XSS)
- Sonatype Nexus Repository
- Cross-site scripting (XSS)
Not analysed yet 4 Dec 2025
CVE-2025-9868 CVE record

CVSS 8.7 High

Nexus Repository 2 - SSRF Vulnerability in Remote Browser Plugin
- Sonatype Nexus Repository
- Server-side request forgery (SSRF)
Not analysed yet 8 Oct 2025
CVE-2024-5082 CVE record

CVSS 7.1 High

Nexus Repository 2 - Remote Code Execution
- Sonatype Nexus Repository
- Code injection
Not analysed yet 14 Nov 2024
CVE-2024-5083 CVE record

CVSS 5.1 Medium

Nexus Repository 2 - Stored XSS
- Sonatype Nexus Repository
- Cross-site scripting (XSS)
Not analysed yet 14 Nov 2024
CVE-2024-5764 CVE record

CVSS 5.9 Medium

Nexus Repository 3 - Static hard-coded encryption passphrase used by default
- Sonatype Nexus Repository
- Hard-coded credentials
Not analysed yet 23 Oct 2024
CVE-2024-4956 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Nexus Repository 3 - Path Traversal
- Sonatype Nexus Repository
- Path traversal
Not analysed yet 16 May 2024