Skip to content
OpenAdvisories

Vendor

Sonatype

49 known vulnerabilities.

Products

Nexus Repository 3 29 Nexus Repository 16 Nexus Repository Manager 3 IQ Server 1 org.sonatype.security:security-system 1 org.sonatype.nexus:nexus-security 1 org.sonatype.nexus.common.components:nexus-security 1
All Critical High Medium Low Exploited only Public exploit

49 results · Feed

  • Medium 6.2
    CVE-2026-0600

    Nexus Repository 3 - Server-Side Request Forgery in Proxy Repository Configuration

    Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators to configure proxy repositories with URLs that can access unintended network destinations, potentially including cloud…

    Sonatype Nexus Repository
  • Medium 5.1
    CVE-2026-0601

    Nexus Repository 3 - Cross-Site Scripting

    A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted request requiring user interaction.

    Sonatype Nexus Repository
  • Medium 5.1
    CVE-2025-13488

    Nexus Repository 3 - Stored Cross-Site Scripting (XSS)

    Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This may allow an authenticated attacker with repository upload privileges to exploit a stored cross-site scrip…

    Sonatype Nexus Repository
  • High 8.7
    CVE-2025-9868

    Nexus Repository 2 - SSRF Vulnerability in Remote Browser Plugin

    Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.

    Sonatype Nexus Repository
  • High 7.1
    CVE-2024-5082 Public exploit Scanner template

    Nexus Repository 2 - Remote Code Execution

    A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2.  This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.

    Sonatype Nexus Repository
  • Medium 5.1
    CVE-2024-5083 Public exploit

    Nexus Repository 2 - Stored XSS

    A stored Cross-site Scripting vulnerability has been discovered in Sonatype Nexus Repository 2 This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.

    Sonatype Nexus Repository
  • Medium 5.9
    CVE-2024-5764 Public exploit

    Nexus Repository 3 - Static hard-coded encryption passphrase used by default

    Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database (SMTP or HTTP proxy credentials, user tokens, tokens, among o…

    Sonatype Nexus Repository
  • High 7.5
    CVE-2024-4956 Public exploit Scanner template EPSS 19%

    Nexus Repository 3 - Path Traversal

    Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.

    Sonatype Nexus Repository
  • Medium 5.4
    CVE-2024-1142

    Sonatype IQ Server - Path Traversal

    Path Traversal in Sonatype IQ Server from version 143 allows remote authenticated attackers to overwrite or delete files via a specially crafted request. Version 171 fixes this issue.

    Sonatype IQ Server