[ Vendor · 6 CVEs ]
Sonatype
CVEs affecting Sonatype published in the last 30 days, plus any Sonatype CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-97712 | 15 Oct 2026 | CVSS 8.7 | Sonatype Nexus Repository 3Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does… | |
| CVE-2026-97665 | 15 Oct 2026 | CVSS 7.1 | Sonatype Nexus Repository 3A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse… | |
| CVE-2026-97666 | 15 Oct 2026 | CVSS 6.9 | Sonatype Nexus Repository 3Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an… | |
| CVE-2026-97667 | 15 Oct 2026 | CVSS 5.1 | Sonatype Nexus Repository 3Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of… | |
| CVE-2020-10199 | 1 Apr 2020 | CVSS 8.8 | Sonatype Nexus Repository Remote Code ExecutionSonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). | ExploitedFix |
| CVE-2019-7238 | 21 Mar 2019 | CVSS 9.8 | Sonatype Nexus Repository Manager Incorrect Access ControlSonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. | Exploited |