Sonatype Nexus Repository Manager: Mehrere Schwachstellen
NEOSEC enrichment — no mirror of the original source
Ein Angreifer kann mehrere Schwachstellen in Sonatype Nexus Repository Manager ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, beliebigen Programmcode auszuführen oder Administratorrechte zu erlangen, sowie um einen Cross-Site Scripting Angriff…
Source: BSI CERT-Bund. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at BSI CERT-BundFull advisory
Mediumbsi:WID-SEC-2026-40044 linked CVEs
Open advisory with all CVEs
More on Repository
Other advisories
- Not ratedosv:CVE-2026-117469File-transfer type confusion permits unauthorized repository writes in Psono Server
- Not ratedosv:CLEANSTART-2026-KI36555mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS
- Lowghsa:GHSA-h4fr-cmh5-qr62Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root
- Not ratedosv:GHSA-h4fr-cmh5-qr62Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root
- LowCVE-2026-115569Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
- LowCVE-2026-115569Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
- Not ratedosv:CVE-2026-115569Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
- Not ratedosv:CVE-2026-55222Isar: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrap
Other news entries
- Gheist turns GitHub Actions into a secret extraction serviceNewsCSO Online
- Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions LogsNewsThe Hacker News
- Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release PipelineNewsThe Hacker News
- Hallucinated domain in official OpenAI skill underscores AI supply chain risksNewsCSO Online
- Fake Arch Linux packages push malware with root privilegesNewsBleepingComputer
- Over 1,500 npm packages exposed by Trusted Publishing validation flawNewsCSO Online
- Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp RegistryNewsThe Hacker News
- Gemini broke into 3 companies, but Google kept it quiet because ‘no damage was done’NewsCSO Online
Source: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4004
ID