Product by Sonatype

    Nexus Repository 3

    22 known vulnerabilities in Nexus Repository 3 (Sonatype), 0 of them actively exploited (CISA KEV).

    Key figures

    22

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    0

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Nexus Repository 3 (Sonatype)
    HighCVE-2026-17594

    Nexus Repository 3 - Authorization Bypass in Repository Creation

    also in 1 other product

    		4.9
    HighCVE-2026-17603

    Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API

    also in 1 other product

    		8.8
    HighCVE-2026-77124

    Nexus Repository 3 - Script Execution Disable Setting Not Enforced

    also in 1 other product

    		7.2
    HighCVE-2026-14644

    Nexus Repository 3 - Privilege Escalation

    also in 1 other product

    		7.2
    MediumCVE-2026-97666

    Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint

    also in 1 other product

    		—
    HighCVE-2026-17601

    Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator

    also in 1 other product

    		7.2
    HighCVE-2026-17600

    Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation

    also in 1 other product

    		8.8
    HighCVE-2026-97712

    Nexus Repository 3 - Privilege Escalation via Role Management

    also in 1 other product

    		—
    HighCVE-2026-17599

    Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint

    also in 1 other product

    		7.2
    HighCVE-2026-97665

    Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload

    also in 1 other product

    		—
    MediumCVE-2026-77123

    Nexus Repository 3 - Webhook Secret Disclosure via Capability Read API

    also in 1 other product

    		6.5
    HighCVE-2026-14504

    Nexus Repository 3 - Authorization Bypass in Component Upload API

    also in 1 other product

    		6.5
    HighCVE-2026-14646

    Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect

    also in 1 other product

    		7.7
    MediumCVE-2026-17596

    Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store Name

    also in 1 other product

    		6.1
    HighCVE-2026-77125

    Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints

    also in 1 other product

    		7.1
    MediumCVE-2026-97667

    Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI

    also in 1 other product

    		—
    MediumCVE-2026-77121

    Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields

    also in 1 other product

    		6.5
    MediumCVE-2026-17598

    Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration

    also in 1 other product

    		4.9
    MediumCVE-2026-17595

    Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass

    also in 1 other product

    		2.7
    MediumCVE-2026-14645

    Nexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global Capability

    also in 1 other product

    		5.5
    MediumCVE-2026-77122

    Sonatype Nexus Repository 3: Incorrect Authorization

    also in 1 other product

    		4.3
    MediumCVE-2026-17597

    Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification

    also in 1 other product

    		2.7

    All products by Sonatype