Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Nexus Repository 3 — Vulnerabilities & Security Advisories 18

All 18 CVE vulnerabilities found in Nexus Repository 3, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities for Sonatype Nexus Repository 3, focusing on critical product weaknesses and related technical advisories. The collection covers a range of security flaws, including improper input validation, outdated component dependencies, and authentication bypasses documented across the product's available release history. Readers can use this resource to track the vendor's published advisories, understand common weakness classes affecting this repository server, and review the vulnerability history associated with specific versions. The data is presented in a structured format, enabling security teams to identify recurring patterns and prioritize remediation efforts without navigating scattered individual reports.

Vendor: Sonatype

CVE ID Title CVSS Severity Published
CVE-2026-77123 Nexus Repository 3 - Webhook Secret Disclosure via Capability Read API CWE-201 6.0 Medium 2026-09-02
CVE-2026-77122 Nexus Repository 3 - Incorrect Authorization Allows Disclosure of Member Repository Metadata via Group Repository Permissions CWE-863 5.3 Medium 2026-09-02
CVE-2026-77124 Nexus Repository 3 - Script Execution Disable Setting Not Enforced CWE-184 7.5 High 2026-09-02
CVE-2026-77121 Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields CWE-770 5.3 Medium 2026-09-02
CVE-2026-77125 Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints CWE-863 7.1 High 2026-09-02
CVE-2026-14644 Nexus Repository 3 - Privilege Escalation CWE-843 8.6 High 2026-08-07
CVE-2026-17595 Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass CWE-497 5.3 Medium 2026-08-07
CVE-2026-17596 Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store Name CWE-79 6.3 Medium 2026-08-07
CVE-2026-17594 Nexus Repository 3 - Authorization Bypass in Repository Creation CWE-863 8.2 High 2026-08-07
CVE-2026-17598 Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration CWE-915 5.3 Medium 2026-08-07
CVE-2026-17599 Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint CWE-620 6.9 Medium 2026-08-07
CVE-2026-17597 Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification CWE-918 5.1 Medium 2026-08-07
CVE-2026-17603 Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API CWE-94 8.7 High 2026-08-07
CVE-2026-17600 Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation CWE-613 8.7 High 2026-08-07
CVE-2026-17601 Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator CWE-862 8.9 High 2026-08-07
CVE-2026-14646 Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect CWE-918 - - 2026-07-14
CVE-2026-14645 Nexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global Capability CWE-918 - - 2026-07-14
CVE-2026-14504 Nexus Repository 3 - Authorization Bypass in Component Upload API CWE-862 - - 2026-07-14

All 18 known CVE vulnerabilities affecting Nexus Repository 3 with full Chinese analysis, references, and POCs where available.