Filtered by vendor Sonatype
Subscribe
Total
72 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-5189 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-26 | N/A | 9.8 CRITICAL |
| CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration to be enabled. | |||||
| CVE-2026-7308 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-26 | N/A | 5.4 MEDIUM |
| An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perform actions in the context of the victim's session. | |||||
| CVE-2026-3048 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-26 | N/A | 3.8 LOW |
| An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiate unintended server-side connections when interacting with a malicious LDAP server. | |||||
| CVE-2026-10741 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-26 | N/A | 4.9 MEDIUM |
| Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configuration that allows a delegated repository administrator to disclose stored upstream proxy credentials. | |||||
| CVE-2026-3329 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-26 | N/A | 7.5 HIGH |
| A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints. | |||||
| CVE-2026-10748 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-25 | N/A | 7.2 HIGH |
| An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0. | |||||
| CVE-2026-11403 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-24 | N/A | 7.5 HIGH |
| A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable. | |||||
| CVE-2026-14646 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-24 | N/A | 7.7 HIGH |
| Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymous user, if anonymous access is enabled — could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials. | |||||
| CVE-2026-7494 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-24 | N/A | 5.0 MEDIUM |
| Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects Nexus Repository 3.0.0 through versions prior to 3.94.0. | |||||
| CVE-2026-14645 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-24 | N/A | 5.5 MEDIUM |
| Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations (Server-Side Request Forgery). This permission is granted by role assignment, independent of authentication status, so an unauthenticated user could also trigger this behavior if the anonymous role has been granted the permission. | |||||
| CVE-2026-14504 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-24 | N/A | 6.5 MEDIUM |
| An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended write-permission check. | |||||
| CVE-2026-17601 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-23 | N/A | 7.2 HIGH |
| A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment. | |||||
| CVE-2026-17603 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-23 | N/A | 8.8 HIGH |
| Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user. | |||||
| CVE-2026-17598 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-23 | N/A | 4.9 MEDIUM |
| Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one. | |||||
| CVE-2026-17600 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-23 | N/A | 8.8 HIGH |
| Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue using their existing session to interact with the repository as though the account were still active, until that session independently expired. Depending on the permissions previously held, this could allow continued unauthorized access to read, modify, or delete repository content after access was intended to be revoked. | |||||
| CVE-2026-17599 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-23 | N/A | 7.2 HIGH |
| Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result, an account holding the nexus:* permission could invoke the endpoint outside the intended onboarding flow to replace the administrator password, and existing sessions were not invalidated after the change. | |||||
| CVE-2026-77121 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-07 | N/A | 6.5 MEDIUM |
| A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only the targeted repository is affected; other repositories and overall server health remain unaffected. | |||||
| CVE-2020-11753 | 1 Sonatype | 1 Nexus Repository Manager | 2026-09-22 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or API. NOTE: in 3.22.0, scripting is disabled by default (making this not exploitable). | |||||
| CVE-2021-29158 | 1 Sonatype | 1 Nexus Repository Manager | 2026-09-22 | 4.0 MEDIUM | 4.9 MEDIUM |
| Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control. | |||||
| CVE-2021-40143 | 1 Sonatype | 1 Nexus Repository Manager | 2026-09-22 | 6.4 MEDIUM | 8.2 HIGH |
| Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance. | |||||