Vulnerabilities in Sonatype
42 resultsCVE-2026-10748HIGHNexus Repository 3 - Remote Code Execution via License DeserializationEPSS 0.3%CVE-2026-11403HIGHNexus Repository Manager - Insufficient Entropy in Format-Specific API Key GenerationEPSS 0.3%CVE-2026-0600MEDIUMNexus Repository 3 - Server-Side Request Forgery in Proxy Repository ConfigurationEPSS 0.3%CVE-2026-77125HIGHNexus Repository 3 - Incorrect Authorization on Blobstore Group EndpointsEPSS 0.3%CVE-2026-17601HIGHNexus Repository 3 - Wildcard Privilege Update Self-Escalation to AdministratorEPSS 0.3%CVE-2026-3048MEDIUMNexus Repository 3 - Improper LDAP Referral HandlingEPSS 0.3%CVE-2026-77122MEDIUMNexus Repository 3 - Incorrect Authorization Allows Disclosure of Member Repository Metadata via Group Repository PermissionsEPSS 0.3%CVE-2026-10741MEDIUMNexus Repository Manager - Incorrect Authorization allows credential disclosure via proxy repository configurationEPSS 0.3%CVE-2026-14646MEDIUMNexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP RedirectEPSS 0.3%CVE-2026-14645MEDIUMNexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global CapabilityEPSS 0.3%CVE-2026-77121MEDIUMNexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata FieldsEPSS 0.3%CVE-2026-17600HIGHNexus Repository 3 - Session Not Invalidated on User Account Deletion or DeactivationEPSS 0.2%CVE-2026-17596MEDIUMNexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store NameEPSS 0.2%CVE-2026-17595MEDIUMNexus Repository 3 - JEXL Content Selector Sandbox Property-Read BypassEPSS 0.2%CVE-2026-17598MEDIUMNexus Repository 3 - Improper Input Validation in Scheduled Task ConfigurationEPSS 0.2%CVE-2026-17597MEDIUMNexus Repository 3 - Server-Side Request Forgery via Email Configuration VerificationEPSS 0.2%CVE-2026-14504HIGHNexus Repository 3 - Authorization Bypass in Component Upload APIEPSS 0.2%CVE-2026-7494MEDIUMNexus Repository - SSRF in SSL Certificate RetrievalEPSS 0.2%CVE-2026-97666MEDIUMNexus Repository 3 - Unsafe Reflection in ExtDirect Repository EndpointEPSS —CVE-2026-97665HIGHNexus Repository 3 - Missing Authorization on NuGet Symbol Package UploadEPSS —