Log in Start free

Sonatype

Products

ProductCVEsExploitedLatest
Nexus Repository 329–Nov 4, 2026
Nexus Repository16–Aug 7, 2026
Nexus Repository Manager3–Jul 14, 2026
IQ Server1–Mar 6, 2024
org.sonatype.nexus.common.components:nexus-security1–Aug 7, 2026
org.sonatype.nexus:nexus-security1–Aug 7, 2026
org.sonatype.security:security-system1–Aug 7, 2026

Exploited and recent CVEs

  • CVE-2026-113368 Medium 5.3 Nexus Repository 3 - Group Repository Member Authorization Bypass 0.2%
  • CVE-2026-113369 Medium 6.3 Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab 0.2%
  • CVE-2026-113370 High 7.7 Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task 0.2%
  • CVE-2026-113371 High 7.1 Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase 0.2%
  • CVE-2026-113372 High 7.1 Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Key 0.2%
  • CVE-2026-113373 Critical 9.1 Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again 0.2%
  • CVE-2026-113374 High 8.6 Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation 0.3%
  • CVE-2026-97712 High 8.7 Nexus Repository 3 - Privilege Escalation via Role Management 0.3%
  • CVE-2026-97667 Medium 5.1 Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI 0.3%
  • CVE-2026-97666 Medium 6.9 Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint 0.6%
  • CVE-2026-97665 High 7.1 Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload 0.3%
  • CVE-2026-77121 Medium 5.3 Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields 0.3%
  • CVE-2026-77122 Medium 5.3 Nexus Repository 3 - Incorrect Authorization Allows Disclosure of Member Repository Metadata via Group Repository Permissions 0.3%
  • CVE-2026-77123 Medium 6.0 Nexus Repository 3 - Webhook Secret Disclosure via Capability Read API 0.5%
  • CVE-2026-77124 High 7.5 Nexus Repository 3 - Script Execution Disable Setting Not Enforced 0.7%
  • CVE-2026-77125 High 7.1 Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints 0.3%
  • CVE-2026-14644 High 8.6 Nexus Repository 3 - Privilege Escalation 0.6%
  • CVE-2026-17593 High 7.2 Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration 0.8%
  • CVE-2026-17594 High 8.2 Nexus Repository 3 - Authorization Bypass in Repository Creation 1.0%
  • CVE-2026-17595 Medium 5.3 Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass 0.4%
  • CVE-2026-17596 Medium 6.3 Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store Name 0.4%
  • CVE-2026-17598 Medium 5.3 Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration 0.4%
  • CVE-2026-17599 Medium 6.9 Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint 0.5%
  • CVE-2026-17600 High 8.7 Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation 0.4%
  • CVE-2026-17600 High 8.7 Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation 0.4%
  • CVE-2026-17600 High 8.7 Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation 0.4%
  • CVE-2026-17600 High 8.7 Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation 0.4%
  • CVE-2026-17601 High 8.9 Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator 0.5%
  • CVE-2026-17603 High 8.7 Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API 0.9%
  • CVE-2026-17597 Medium 5.1 Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification 0.3%