Product by Sonatype

    Sonatype Nexus Repository 3

    68 known vulnerabilities in Sonatype Nexus Repository 3 (Sonatype), 1 of them actively exploited (CISA KEV).

    Key figures

    68

    Vulnerabilities

    1

    Actively exploited (KEV)

    0

    Used by ransomware

    5

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Sonatype Nexus Repository 3 (Sonatype)
    CriticalCVE-2019-7238

    Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability

    In CISA KEV

    		9.8
    HighCVE-2019-5475

    Nexus Repository Manager: OS Command Injection

    		8.8
    HighCVE-2019-15588

    Nexus Repository Manager: Command Injection

    		7.2
    HighCVE-2018-16621

    Sonatype Nexus Repository 3: security vulnerability

    		7.2
    MediumCVE-2021-37152

    Sonatype Nexus Repository 3: Cross-Site Scripting (XSS)

    		5.4
    HighCVE-2020-15012

    Sonatype Nexus Repository 3: Path Traversal

    		8.6
    HighCVE-2019-16530

    Sonatype Nexus Repository 3: Remote Code Execution

    		7.2
    HighCVE-2020-15871

    Sonatype Nexus Repository 3: Remote Code Execution

    		8.8
    HighCVE-2021-40143

    Sonatype Nexus Repository 3: security vulnerability

    		8.2
    HighCVE-2026-17594

    Nexus Repository 3 - Authorization Bypass in Repository Creation

    also in 1 other product

    		4.9
    HighCVE-2026-17603

    Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API

    also in 1 other product

    		8.8
    CriticalCVE-2019-9629

    Sonatype Nexus Repository 3: security vulnerability

    		9.8
    HighCVE-2020-11753

    Sonatype Nexus Repository 3: security vulnerability

    		8.8
    HighCVE-2019-15893

    Sonatype Nexus Repository 3: Remote Code Execution

    		7.2
    HighCVE-2026-77124

    Nexus Repository 3 - Script Execution Disable Setting Not Enforced

    also in 1 other product

    		7.2
    MediumCVE-2021-34553

    Sonatype Nexus Repository 3: security vulnerability

    		4.3
    HighCVE-2026-14644

    Nexus Repository 3 - Privilege Escalation

    also in 1 other product

    		7.2
    MediumCVE-2026-97666

    Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint

    also in 1 other product

    		—
    HighCVE-2026-17593

    Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration

    also in 1 other product

    		7.2
    HighCVE-2026-17601

    Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator

    also in 1 other product

    		7.2
    CriticalCVE-2026-5189

    Nexus Repository 3 - Hardcoded Credential in Internal Database Component

    also in 1 other product

    		9.8
    CriticalCVE-2026-3199

    Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection

    also in 1 other product

    		8.8
    HighCVE-2026-11403

    Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation

    		7.5
    HighCVE-2019-9630

    Sonatype Nexus Repository 3: security vulnerability

    		7.5
    HighCVE-2026-17600

    Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation

    also in 1 other product

    		8.8

    All vulnerabilities in search

    All products by Sonatype