Product by Sonatype
Nexus Repository
16 known vulnerabilities in Nexus Repository (Sonatype), 0 of them actively exploited (CISA KEV).
Key figures
16
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2024-4956 | Nexus Repository 3 - Path Traversal | 7.5 | |
| High | CVE-2024-5082 | Nexus Repository 2 - Remote Code Execution | — | |
| High | CVE-2026-17593 | Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration | 7.2 | |
| Critical | CVE-2026-5189 | Nexus Repository 3 - Hardcoded Credential in Internal Database Component | 9.8 | |
| Critical | CVE-2026-3199 | Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection | 8.8 | |
| High | CVE-2025-9868 | Nexus Repository 2 - SSRF Vulnerability in Remote Browser Plugin | — | |
| High | CVE-2026-10748 | Nexus Repository 3 - Remote Code Execution via License Deserialization | 7.2 | |
| Medium | CVE-2026-3438 | Nexus Repository 3 - Reflected Cross-Site Scripting (XSS) in ?describe Pages | 6.1 | |
| Medium | CVE-2026-0601 | Nexus Repository 3 - Cross-Site Scripting | — | |
| Medium | CVE-2026-0600 | Nexus Repository 3 - Server-Side Request Forgery in Proxy Repository Configuration | — | |
| Medium | CVE-2024-5764 | Nexus Repository 3 - Static hard-coded encryption passphrase used by default | 6.5 | |
| Medium | CVE-2026-7494 | Nexus Repository - SSRF in SSL Certificate Retrieval | 5.0 | |
| Medium | CVE-2026-7308 | Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via HTML Browse Page | 5.4 | |
| Medium | CVE-2025-13488 | Nexus Repository 3 - Stored Cross-Site Scripting (XSS) | — | |
| Medium | CVE-2026-3048 | Nexus Repository 3 - Improper LDAP Referral Handling | 3.8 | |
| Medium | CVE-2024-5083 | Nexus Repository 2 - Stored XSS | — |