Security Advisories
Important advisories of known security vulnerabilities in Sonatype products.
- CVE-2026-17603 Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API - 2026-08-07
- CVE-2026-17601 Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator - 2026-08-07
- CVE-2026-17600 Nexus Repository 3 - Session Not Invalidated on Account Deletion or Deactivation - 2026-08-07
- CVE-2026-17599 Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint - 2026-08-07
- CVE-2026-17598 Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration - 2026-08-07
- CVE-2026-17597 Nexus Repository 3 - SSRF via Email Configuration Verification - 2026-08-07
- CVE-2026-17596 Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store Name - 2026-08-07
- CVE-2026-17595 Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass - 2026-08-07
- CVE-2026-17594 Nexus Repository 3 - Authorization Bypass in Repository Creation - 2026-08-07
- CVE-2026-17593 Nexus Repository 3 - Arbitrary Class Instantiation via Unsafe Realm Configuration - 2026-08-07
- CVE-2026-14646 Nexus Repository 3 - SSRF via HTTP Redirect - 2026-07-14
- CVE-2026-14645 Nexus Repository 3 - Webhook SSRF - 2026-07-14
- CVE-2026-14644 Nexus Repository 3 - Privilege Escalation - 2026-08-07
- CVE-2026-14504 Nexus Repository 3 - Authorization Bypass in Component Upload API - 2026-07-14
- CVE-2026-7494 Nexus Repository 3 - SSRF in SSL Certificate Retrieval - 2026-07-14
- CVE-2026-3329 Nexus Repository 3 - Authentication Handling Issue - 2026-06-11
- CVE-2026-11403 Nexus Repository 3 - Insufficient Entropy in API Key Generation - 2026-07-14
- CVE-2026-10741 Nexus Repository 3 - Incorrect Authorization - 2026-06-17
- CVE-2026-10748 Nexus Repository 3 - Remote Code Execution - 2026-06-16
- CVE-2026-7308 Nexus Repository 3 - Stored Cross-Site Scripting (XSS) - 2026-05-11
- CVE-2026-3048 Nexus Repository 3 - Improper LDAP Referral Handling - 2026-05-11
- CVE-2026-5189 Nexus Repository 3 - Hardcoded Credential in Internal Database Component - 2026-04-15
- CVE-2026-3199 Nexus Repository 3 - Authenticated Remote Code Execution - 2026-04-08
- CVE-2026-3438 Nexus Repository 3 - Reflected Cross-Site Scripting (XSS) - 2026-04-08
- CVE-2026-0601 Nexus Repository 3 - Cross-Site Scripting - 2026-01-13
- CVE-2026-0600 Nexus Repository 3 - Server-Side Request Forgery - 2026-01-13
- CVE-2025-13488 Nexus Repository 3 - Stored Cross-Site Scripting (XSS) - 2025-12-04
- CVE-2025-9868 Nexus Repository 2 – SSRF Vulnerability in Remote Browser Plugin
- CVE-2024-5764 - Nexus Repository Manager 3 - Static hard-coded encryption passphrase used by default - 2024-10-17
- CVE-2024-5082 Nexus Repository 2 - Remote Code Execution