Sonatype Nexus Repository: known vulnerabilities by version
Sonatype lists 194 Sonatype Nexus Repository 3.x (OSS, Community and Pro) versions. 194 of them carry at least one known CVE by NVD's exact CPE match or Sonatype's advisories and have a page here; none is free of known CVEs. 66 CVEs are on record. Latest release: 3.96.2 (September 18, 2026).
Sources: NVD (exact CPE match and the published configurations), the CVE Program record (the vendor's CNA entry with its affected and fixed versions), Sonatype's security advisories, release notes and end-of-life page. Pulled September 18, 2026. Every CVE row links to its NVD record and to the vendor's advisory.
Check a Nexus Repository version
Paste the version your server reports. Build suffixes such as -02 and a leading v are fine.
Every version, by branch
Newest branch first. Each version shows its known-CVE count and Sonatype's end-of-life status. A version without a link has no known CVE and no page.
3.96.x
3.95.x
3.94.x
3.93.x
3.92.x
3.90.x
3.87.x
3.86.x
3.84.x
3.83.x
3.78.x
3.74.x
3.73.x
3.72.x
3.71.x
3.70.x
3.69.x
3.66.x
3.65.x
3.64.x
3.63.x
3.62.x
3.61.x
3.60.x
3.59.x
3.56.x
3.55.x
3.52.x
3.51.x
3.50.x
3.49.x
3.48.x
3.46.x
3.44.x
3.43.x
3.42.x
3.39.x
3.37.x
3.36.x
3.35.x
3.27.x
3.23.x
3.20.x
3.15.x
3.14.x
3.13.x
3.11.x
3.10.x
3.9.x
3.8.x
3.4.x
3.1.x
About this page and CloudRepo
CloudRepo is a managed artifact repository, so there is no Artifactory or Nexus server for you to patch. In over 10 years of operation, CloudRepo has experienced no known security breaches. This page is not a scan of your server: the data is NVD's and the vendor's, linked on every row, pulled on September 18, 2026.
Read next
Look up another version
Looking for JFrog Artifactory? Every JFrog Artifactory version.