What’s Vulnerable › Products

Sonatype Nexus Repository 3 vulnerabilities

75 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 39 published in the last 12 months.

Check whether your Sonatype Nexus Repository 3 version is affected

Exploited Sonatype Nexus Repository 3 vulnerabilities

• CVE-2019-7238 — Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability

Latest Sonatype Nexus Repository 3 vulnerabilities

• CVE-2026-97712 — Nexus Repository 3 - Privilege Escalation via Role Management (CVSS 8.7)
• CVE-2026-97667 — Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI (CVSS 5.1)
• CVE-2026-97666 — Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint (CVSS 6.9)
• CVE-2026-97665 — Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload (CVSS 7.1)
• CVE-2026-77125 — Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints (CVSS 7.1)
• CVE-2026-77124 — Nexus Repository 3 - Script Execution Disable Setting Not Enforced (CVSS 7.2)
• CVE-2026-77123 — Nexus Repository 3 - Webhook Secret Disclosure via Capability Read API (CVSS 6.5)
• CVE-2026-77122 — Nexus Repository 3 - Incorrect Authorization Allows Disclosure of Member Repository Metadata via Group Repository Permissions (CVSS 4.3)
• CVE-2026-77121 — Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields (CVSS 6.5)
• CVE-2026-17603 — Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API (CVSS 8.8)
• CVE-2026-17601 — Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator (CVSS 7.2)
• CVE-2026-17600 — Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation (CVSS 8.8)
• CVE-2026-17599 — Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint (CVSS 7.2)
• CVE-2026-17598 — Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration (CVSS 4.9)
• CVE-2026-17597 — Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification (CVSS 2.7)
• CVE-2026-17596 — Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store Name (CVSS 6.1)
• CVE-2026-17595 — Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass (CVSS 2.7)
• CVE-2026-17594 — Nexus Repository 3 - Authorization Bypass in Repository Creation (CVSS 4.9)
• CVE-2026-17593 — Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration (CVSS 7.2)
• CVE-2026-14644 — Nexus Repository 3 - Privilege Escalation (CVSS 7.2)
• CVE-2026-14646 — Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect (CVSS 7.7)
• CVE-2026-14645 — Nexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global Capability (CVSS 5.5)
• CVE-2026-7494 — Nexus Repository - SSRF in SSL Certificate Retrieval (CVSS 5.0)
• CVE-2026-14504 — Nexus Repository 3 - Authorization Bypass in Component Upload API (CVSS 6.5)
• CVE-2026-11403 — Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation (CVSS 7.5)