Skip to content
OpenAdvisories

Vendor

Sonatype

49 known vulnerabilities.

Products

Nexus Repository 3 29 Nexus Repository 16 Nexus Repository Manager 3 IQ Server 1 org.sonatype.security:security-system 1 org.sonatype.nexus:nexus-security 1 org.sonatype.nexus.common.components:nexus-security 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-113373

    Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again

    Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in …

    Sonatype Nexus Repository 3
  • Critical 9.2
    CVE-2026-5189

    Nexus Repository 3 - Hardcoded Credential in Internal Database Component

    CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands …

    Sonatype Nexus Repository
  • Critical 9.4
    CVE-2026-3199

    Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection

    A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.

    Sonatype Nexus Repository