Nexus 3.5.0 49 known CVEs
Support status: Not listed. This version predates Sonatype's versions status page.
- Released not published
- Support status Not listed
- Latest release 3.97.2, October 23, 2026
- Behind latest not computable
- Lowest upgrade that fixes 48 of 49 3.97.0
- Critical 3 High 18 Medium 26 Low 2
A lookup, not a scan of your server. 45 of the 49 come from NVD's exact CPE match, and 4 more from Sonatype's advisories that NVD has not analyzed. Pulled October 23, 2026. Sources and method
Tired of patching Nexus yourself?
This is what we do. We host your Maven, npm, PyPI and Docker repositories, so there's no Nexus server to upgrade or patch.
Our migration tool, free to use with CloudRepo, moves your hosted repositories over from Nexus 3 and checks every file.
Upgrade path
3.97.0 fixes 48 of these 49. For the 49th (CVE-2026-0600), Sonatype publishes a workaround, not a fix.
What upgrading costs, in Sonatype's words
- If your server runs on OrientDB, Sonatype says "Before updating to a release after 3.70.x, you must migrate off from the Orient database while upgrading Java." (Sonatype's upgrade page, read October 31, 2026)
- The same page says "Nexus Repository 3.70.x is the last release that supports OrientDB." (Sonatype's upgrade page, read October 31, 2026)
- Sonatype lists the 3.70.x releases as Sunsetted, with a sunset date of January 9, 2026. (Sonatype's versions status page, read October 31, 2026)
- If you run the free edition, Sonatype says "As of version 3.77.0, the free edition of Nexus Repository is now called Sonatype Nexus Repository Community Edition." (Sonatype's 3.77.0 release notes, read October 31, 2026)
- Sonatype gives "the Community Edition usage limits of 40,000 total components or 100,000 requests per day", and says that over a limit "users are not able to add new components until the deployment returns to being under both of these limits." (Sonatype's Usage Center page, read October 31, 2026)
Both costs, with every source: Nexus Community Edition limits and Stuck on Nexus 3.70 (OrientDB)? Upgrade or move.
No known security breaches in our history.
The 49 CVEs that affect 3.5.0
Sorted by severity. A CVE counts when either NVD or Sonatype says this version is affected; both verdicts are shown. Latest release: 3.97.2.
| CVE | Severity | NVD | Sonatype | Fix |
|---|---|---|---|---|
| CVE-2019-7238 March 21, 2019 | Critical 9.8 CVSS 3.1 9.8, rated by NVD | yes | no Sonatype CNA range | No Sonatype CNA range; NVD's range ends before 3.15.0. See Sonatype's advisory. |
Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.15.0. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2019-9629 July 8, 2019 | Critical 9.8 CVSS 3.0 9.8, rated by NVD | yes | no Sonatype CNA range | No Sonatype CNA range; NVD's range ends before 3.17.0. See Sonatype's advisory. |
Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).NVD configuration (NVD status: Modified): before 3.17.0. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2026-5189 April 15, 2026 | Critical 9.8 CVSS 3.1 9.8, rated by NVD | yes | yes | 3.71.0 nearest fix; none on your branch |
CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user.Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration to be enabled. NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.71.0. Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions 3.0.0 through 3.70.5. | ||||
| CVE-2020-10199 April 1, 2020 | High 8.8 CVSS 3.1 8.8, rated by NVD | yes | yes | 3.21.2 nearest fix; none on your branch |
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).NVD configuration (NVD status: Analyzed): before 3.21.2. Sonatype: All previous Nexus Repository 3.x OSS/Pro versions up to and including 3.21.1. | ||||
| CVE-2020-11444 April 2, 2020 | High 8.8 CVSS 3.1 8.8, rated by NVD | yes | yes | 3.22.0 nearest fix; none on your branch |
Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.NVD configuration (NVD status: Modified): from 3.0.0 (including), through 3.21.2. Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.21.2. | ||||
| CVE-2020-15871 July 31, 2020 | High 8.8 CVSS 3.1 8.8, rated by NVD | yes | no Sonatype CNA range | No Sonatype CNA range; NVD's range ends before 3.25.1. See Sonatype's advisory. |
Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.NVD configuration (NVD status: Analyzed): before 3.25.1. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2026-17600 August 7, 2026 | High 8.8 CVSS 3.1 8.8, rated by NVD | yes | yes | 3.95.0 nearest fix; none on your branch |
Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed.A user whose account was already logged in at the time of one of these actions could continue using their existing session to interact with the repository as though the account were still active, until that session independently expired. Depending on the permissions previously held, this could allow continued unauthorized access to read, modify, or delete repository content after access was intended to be revoked. NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.95.0. Sonatype: All Sonatype Nexus Repository CE/Pro versions prior to 3.95.0. | ||||
| CVE-2026-97712 October 15, 2026 | High 8.7 CVSS 4.0 8.7, rated by Sonatype (CNA) | no NVD data | yes | 3.97.0 nearest fix; none on your branch |
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold.This can give the user more access than intended, up to full administrative access. NVD has published no version configuration for this record (NVD status: Awaiting Analysis). Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.0.0 up to and including 3.96.4. | ||||
| CVE-2021-40143 September 7, 2021 | High 8.2 CVSS 3.1 8.2, rated by NVD | yes | yes | 3.34.0 nearest fix; none on your branch |
Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection.By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance. NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.34.1-01. Sonatype: Nexus Repository 3 versions up to and including 3.33.1. | ||||
| CVE-2026-14646 July 14, 2026 | High 7.7 CVSS 3.1 7.7, rated by NVD | yes | yes | 3.94.0 nearest fix; none on your branch |
Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers.Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server - including an anonymous user, if anonymous access is enabled - could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials. NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.94.0. Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.0.0 up to and including 3.93.x. | ||||
| CVE-2018-16620 November 15, 2018 | High 7.5 CVSS 3.0 7.5, rated by NVD | yes | yes | 3.14.0 nearest fix; none on your branch |
Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control.NVD configuration (NVD status: Modified): before 3.14.0. Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.13.0. | ||||
| CVE-2019-9630 July 8, 2019 | High 7.5 CVSS 3.0 7.5, rated by NVD | yes | no Sonatype CNA range | No Sonatype CNA range; NVD's range ends before 3.17.0. See Sonatype's advisory. |
Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images.NVD configuration (NVD status: Modified): before 3.17.0. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2020-15868 August 12, 2020 | High 7.5 CVSS 3.1 7.5, rated by NVD | yes | no Sonatype CNA range | No Sonatype CNA range; NVD's range ends before 3.26.0. See Sonatype's advisory. |
Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.NVD configuration (NVD status: Modified): before 3.26.0. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2024-4956 May 16, 2024 | High 7.5 CVSS 3.1 7.5, rated by Sonatype (CNA) | no NVD data | yes | 3.68.1 nearest fix; none on your branch |
Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files.Fixed in version 3.68.1. NVD has published no version configuration for this record (NVD status: Deferred). Sonatype: All previous Sonatype Nexus Repository 3.x OSS/Pro versions up to and including 3.68.0. | ||||
| CVE-2026-11403 July 14, 2026 | High 7.5 CVSS 3.1 7.5, rated by NVD | yes | yes | 3.93.0 nearest fix; none on your branch |
A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user.A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable. NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.93.0. Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions before 3.93.0. | ||||
| CVE-2026-3329 June 11, 2026 | High 7.5 CVSS 3.1 7.5, rated by NVD | yes | yes | 3.93.0 nearest fix; none on your branch |
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.93.0. Sonatype: All Sonatype Nexus Repository versions from 3.0.0 up to and including 3.92.x. | ||||
| CVE-2018-16621 November 15, 2018 | High 7.2 CVSS 3.1 7.2, rated by NVD | yes | yes | 3.14.0 nearest fix; none on your branch |
Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.NVD configuration (NVD status: Modified): before 3.14.0. Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.13.0. | ||||
| CVE-2019-16530 October 21, 2019 | High 7.2 CVSS 3.1 7.2, rated by NVD | yes | yes | 3.19.0 nearest fix; none on your branch |
Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.NVD configuration (NVD status: Modified): from 2.0.0 (including), through 2.14.14; from 3.0.0 (including), through 3.18.1. Sonatype: Nexus Repository 2 versions up to and including 2.14.14; Nexus Repository 3 versions up to and including 3.18.1; IQ Server versions up to and including 72. | ||||
| CVE-2020-10204 April 1, 2020 | High 7.2 CVSS 3.1 7.2, rated by NVD | yes | no Sonatype CNA range | No Sonatype CNA range; NVD's range ends before 3.21.2. See Sonatype's advisory. |
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.NVD configuration (NVD status: Modified): before 3.21.2. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2026-10748 June 16, 2026 | High 7.2 CVSS 3.1 7.2, rated by NVD | yes | yes | 3.92.0 nearest fix; none on your branch |
An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.92.0. Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions before 3.92.0. | ||||
| CVE-2026-17593 August 7, 2026 | High 7.2 CVSS 3.1 7.2, rated by NVD | yes | yes | 3.95.0 nearest fix; none on your branch |
An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permission in the legacy Nexus Repository 2) could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of registered realms.Because unrecognized entries were persisted and re-evaluated on every realm load via a legacy code path, this could result in unintended code executing inside the Nexus Repository process, and in some cases a persistent authentication lockout that was not visible through the administrative UI. NVD configuration (NVD status: Analyzed): from 2.8.0 (including), before 3.95.0. Sonatype: All previous Sonatype Nexus Repository CE/Pro versions from 2.8.0 up to and including 3.94.x. | ||||
| CVE-2026-97666 October 15, 2026 | Medium 6.9 CVSS 4.0 6.9, rated by Sonatype (CNA) | no NVD data | yes | 3.97.0 nearest fix; none on your branch |
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint.This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution. NVD has published no version configuration for this record (NVD status: Awaiting Analysis). Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions up to and including 3.96.x. | ||||
| CVE-2020-29436 December 17, 2020 | Medium 6.5 CVSS 3.1 6.5, rated by NVD | yes | no Sonatype CNA range | No Sonatype CNA range; NVD's range ends before 3.29.0. See Sonatype's advisory. |
Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability.Fixed in version 3.29.0. NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.29.0. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2024-5764 October 23, 2024 | Medium 6.5 CVSS 3.1 6.5, rated by NVD | yes | yes | 3.73.0 nearest fix; none on your branch |
Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database (SMTP or HTTP proxy credentials, user tokens, tokens, among others).The affected versions relied on a static hard-coded encryption passphrase. While it was possible for an administrator to define an alternate encryption passphrase, it could only be done at first boot and not updated. This issue affects Nexus Repository: from 3.0.0 through 3.72.0. NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.73.0. Sonatype: All previous Sonatype Nexus Repository Manager 3.x OSS/Pro versions up to and including 3.72.0. | ||||
| CVE-2026-77123 September 2, 2026 | Medium 6.5 CVSS 3.1 6.5, rated by NVD | yes | yes | 3.96.0 nearest fix; none on your branch |
Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API.An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. This issue affects Nexus Repository 3 versions 3.2.0 through 3.95.x, and is fixed in version 3.96.0. NVD configuration (NVD status: Analyzed): from 3.2.0 (including), before 3.96.0. Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.2.0 up to and including 3.95.x. | ||||
| CVE-2026-0600 January 14, 2026 | Medium 6.2 CVSS 4.0 6.2, rated by Sonatype (CNA) | no NVD data | yes | No fixed version. Sonatype names a workaround from Sonatype Nexus Repository 3.88.0 (CE/Pro). |
Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators to configure proxy repositories with URLs that can access unintended network destinations, potentially including cloud metadata services and internal network resources.A workaround configuration is available starting in version 3.88.0, but the product remains vulnerable by default. NVD has published no version configuration for this record (NVD status: Deferred). Sonatype: Sonatype Nexus Repository 3.0.0 and later (CE/Pro). | ||||
| CVE-2018-16619 November 15, 2018 | Medium 6.1 CVSS 3.0 6.1, rated by NVD | yes | yes | 3.14.0 nearest fix; none on your branch |
Sonatype Nexus Repository Manager before 3.14 allows XSS.NVD configuration (NVD status: Modified): before 3.14.0. Sonatype: All previous Nexus Repository Manager 3 OSS/Pro versions up to and including 3.13.0. | ||||
| CVE-2018-5306 February 9, 2018 | Medium 6.1 CVSS 3.0 6.1, rated by NVD | yes | yes | 3.8.0 nearest fix; none on your branch |
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; (3) the filename in the "File…Upload" functionality of the Staging Upload; (4) the username when creating a new user; or (5) the IQ Server URL field in the IQ Server Connection functionality. NVD configuration (NVD status: Modified): from 3.0 (including), before 3.8. Sonatype: All previous 3.x Nexus Repository OSS/Pro versions up to and including 3.7.1. | ||||
| CVE-2020-15870 July 31, 2020 | Medium 6.1 CVSS 3.1 6.1, rated by NVD | yes | yes | 3.25.1 nearest fix; none on your branch |
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2).NVD configuration (NVD status: Analyzed): before 3.25.1. Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.25.0. | ||||
| CVE-2026-3438 April 8, 2026 | Medium 6.1 CVSS 3.1 6.1, rated by NVD | yes | yes | 3.91.0 nearest fix; none on your branch |
A reflected cross-site scripting vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2 that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL.Exploitation requires user interaction. NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.91.0. Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions up to and including 3.90.x. | ||||
| CVE-2026-14645 July 14, 2026 | Medium 5.5 CVSS 3.1 5.5, rated by NVD | yes | yes | 3.94.0 nearest fix; none on your branch |
Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations (Server-Side Request Forgery).This permission is granted by role assignment, independent of authentication status, so an unauthenticated user could also trigger this behavior if the anonymous role has been granted the permission. NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.94.0. Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions up to and including 3.93.x. | ||||
| CVE-2020-15869 July 31, 2020 | Medium 5.4 CVSS 3.1 5.4, rated by NVD | yes | yes | 3.25.1 nearest fix; none on your branch |
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2).NVD configuration (NVD status: Analyzed): before 3.25.1. Sonatype: All previous Nexus Repository Manager 3 OSS/Pro versions up to and including 3.25.0. | ||||
| CVE-2021-37152 August 10, 2021 | Medium 5.4 CVSS 3.1 5.4, rated by NVD | yes | yes | 3.33.0 nearest fix; none on your branch |
Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0.An authenticated attacker with the ability to add HTML files to a repository could redirect users to Nexus Repository Manager’s pages with code modifications. NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.33.0. Sonatype: Nexus Repository 3 versions up to and including 3.32.0. | ||||
| CVE-2021-30635 April 27, 2021 | Medium 5.3 CVSS 3.1 5.3, rated by NVD | yes | yes | 3.30.1 nearest fix; none on your branch |
Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-related folder via directory traversal (no customer-specific data is exposed).NVD configuration (NVD status: Modified): from 3.0 (including), before 3.30.1. Sonatype: Nexus Repository Manager 3 versions up to and including 3.30.0. | ||||
| CVE-2026-7494 July 14, 2026 | Medium 5.0 CVSS 3.1 5.0, rated by NVD | yes | yes | 3.94.0 nearest fix; none on your branch |
Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint.A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects Nexus Repository 3.0.0 through versions prior to 3.94.0. NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.94.0. Sonatype: Sonatype Nexus Repository 3 CE/Pro versions 3.0.0 up to and including 3.93.x. | ||||
| CVE-2020-11415 April 27, 2020 | Medium 4.9 CVSS 3.1 4.9, rated by NVD | yes | no Sonatype CNA range | No Sonatype CNA range; NVD's range ends before 3.22.1. See Sonatype's advisory. |
An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1.Admin users can retrieve the LDAP server system username/password (as configured in nxrm) in cleartext. NVD configuration (NVD status: Modified): from 2.0 (including), before 2.14.17; from 3.0 (including), before 3.22.1. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2020-24622 August 25, 2020 | Medium 4.9 CVSS 3.1 4.9, rated by NVD | yes | yes | 3.27.0 nearest fix; none on your branch |
In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.27.0. Sonatype: Nexus Repository 3 versions up to and including 3.26.1. | ||||
| CVE-2021-29158 April 23, 2021 | Medium 4.9 CVSS 3.1 4.9, rated by NVD | yes | yes | 3.30.1 nearest fix; none on your branch |
Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control.NVD configuration (NVD status: Analyzed): through 3.30.0. Sonatype: Nexus Repository Manager 3 Pro versions up to and including 3.30.0. | ||||
| CVE-2026-10741 June 17, 2026 | Medium 4.9 CVSS 3.1 4.9, rated by NVD | yes | yes | 3.93.0 nearest fix; none on your branch |
Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configuration that allows a delegated repository administrator to disclose stored upstream proxy credentials.NVD configuration (NVD status: Analyzed): from 3.1.0 (including), before 3.93.0. Sonatype: All Sonatype Nexus Repository 3.x versions from 3.1.0 through 3.92.x. | ||||
| CVE-2026-17594 August 7, 2026 | Medium 4.9 CVSS 3.1 4.9, rated by NVD | yes | yes | 3.95.0 nearest fix; none on your branch |
Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface.An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0. NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.95.0. Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x. | ||||
| CVE-2018-12100 June 11, 2018 | Medium 4.8 CVSS 3.0 4.8, rated by NVD | yes | yes | 3.12.0 nearest fix; none on your branch |
Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI.NVD configuration (NVD status: Modified): from 3.3.0 (including), before 3.12.0. Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.11.0-01.. | ||||
| CVE-2020-10203 April 1, 2020 | Medium 4.8 CVSS 3.1 4.8, rated by NVD | yes | no Sonatype CNA range | No Sonatype CNA range; NVD's range ends before 3.21.2. See Sonatype's advisory. |
Sonatype Nexus Repository before 3.21.2 allows XSS.NVD configuration (NVD status: Modified): before 3.21.2. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2021-34553 June 18, 2021 | Medium 4.3 CVSS 3.1 4.3, rated by NVD | yes | yes | 3.31.0 nearest fix; none on your branch |
Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access.NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.31.0. Sonatype: Nexus Repository 3 versions up to and including 3.30.1. | ||||
| CVE-2021-42568 November 2, 2021 | Medium 4.3 CVSS 3.1 4.3, rated by NVD | yes | no Sonatype CNA range | No Sonatype CNA range; NVD's range runs through 3.35.0. See Sonatype's advisory. |
Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account.NVD configuration (NVD status: Modified): from 3.0.0 (including), through 3.35.0. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2021-43293 November 4, 2021 | Medium 4.3 CVSS 3.1 4.3, rated by NVD | yes | no Sonatype CNA range | No Sonatype CNA range; NVD's range runs through 3.35.0. See Sonatype's advisory. |
Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery (SSRF).NVD configuration (NVD status: Modified): from 3.0.0 (including), through 3.35.0. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2021-43961 March 17, 2022 | Medium 4.3 CVSS 3.1 4.3, rated by NVD | yes | yes | 3.38.0 nearest fix; none on your branch |
Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection.NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.38.0. Sonatype: Nexus Repository 3 versions up to and including 3.37.3. | ||||
| CVE-2022-27907 March 30, 2022 | Medium 4.3 CVSS 3.1 4.3, rated by NVD | yes | yes | 3.38.0 nearest fix; none on your branch |
Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF.NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.38.0. Sonatype: Nexus Repository 3 versions up to and including 3.37.3. | ||||
| CVE-2026-3048 May 11, 2026 | Low 3.8 CVSS 3.1 3.8, rated by NVD | yes | yes | 3.92.0 nearest fix; none on your branch |
An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiate unintended server-side connections when interacting with a malicious LDAP server.NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.92.0. Sonatype: Sonatype Nexus Repository 3.0.0 through 3.91.x (CE/Pro). | ||||
| CVE-2026-17597 August 7, 2026 | Low 2.7 CVSS 3.1 2.7, rated by NVD | yes | yes | 3.95.0 nearest fix; none on your branch |
Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) vulnerability in the email configuration verification feature.A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt outbound network connections to internal or otherwise restricted network addresses. Differences in the server's response could be used to infer whether internal hosts and ports are reachable. This issue affects Nexus Repository 3 CE/Pro versions up to and including 3.94.1, and is fixed in version 3.95.0. NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.95.0. Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions up to and including 3.94.x. | ||||
21 other Sonatype Nexus Repository CVEs on record that do not affect 3.5.0
Each of these is fixed at or before 3.5.0 on its branch, or its published range does not include this version.
| CVE | Severity | NVD | Sonatype | Fix |
|---|---|---|---|---|
| CVE-2020-11753 April 20, 2020 | High 8.8 CVSS 3.1 8.8, rated by NVD | no | no | Predates the affected range (from 3.21.1). |
Ranges and sources for CVE-2020-11753NVD configuration (NVD status: Analyzed): exactly 3.21.1; exactly 3.22.0. Sonatype: Nexus Repository 3 OSS/Pro versions 3.21.1 and 3.22.0. | ||||
| CVE-2026-17603 August 7, 2026 | High 8.8 CVSS 3.1 8.8, rated by NVD | no | no | Predates the affected range (from 3.20.0). |
Ranges and sources for CVE-2026-17603NVD configuration (NVD status: Analyzed): from 3.20.0 (including), before 3.95.0. Sonatype: All Nexus Repository 3 CE/Pro versions from 3.20.0 up to and including 3.94.x. | ||||
| CVE-2026-3199 April 8, 2026 | High 8.8 CVSS 3.1 8.8, rated by NVD | no | no | Predates the affected range (from 3.22.1). |
Ranges and sources for CVE-2026-3199NVD configuration (NVD status: Analyzed): from 3.22.1 (including), before 3.91.0. Sonatype: Sonatype Nexus Repository 3.22.1 through 3.90.x (CE/Pro). | ||||
| CVE-2026-14644 August 7, 2026 | High 7.2 CVSS 3.1 7.2, rated by NVD | no | no | Predates the affected range (from 3.19.0). |
Ranges and sources for CVE-2026-14644NVD configuration (NVD status: Analyzed): from 3.19.0 (including), before 3.95.0. Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions 3.19.0 through 3.94.x. | ||||
| CVE-2026-17599 August 7, 2026 | High 7.2 CVSS 3.1 7.2, rated by NVD | no | no | Predates the affected range (from 3.17.0). |
Ranges and sources for CVE-2026-17599NVD configuration (NVD status: Analyzed): from 3.17.0 (including), before 3.95.0. Sonatype: All previous Nexus Repository 3 CE/Pro versions from 3.17.0 up to and including 3.94.x. | ||||
| CVE-2026-17601 August 7, 2026 | High 7.2 CVSS 3.1 7.2, rated by NVD | no | no | Predates the affected range (from 3.19.0). |
Ranges and sources for CVE-2026-17601NVD configuration (NVD status: Analyzed): from 3.19.0 (including), before 3.95.0. Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.19.0 through 3.94.x. | ||||
| CVE-2026-77124 September 2, 2026 | High 7.2 CVSS 3.1 7.2, rated by NVD | no | no | Predates the affected range (from 3.21.2). |
Ranges and sources for CVE-2026-77124NVD configuration (NVD status: Analyzed): from 3.21.2 (including), before 3.96.0. Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions from 3.21.2 up to and including 3.95.x. | ||||
| CVE-2026-77125 September 2, 2026 | High 7.1 CVSS 3.1 7.1, rated by NVD | no | no | Predates the affected range (from 3.19.0). |
Ranges and sources for CVE-2026-77125NVD configuration (NVD status: Analyzed): from 3.19.0 (including), before 3.96.0. Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.19.0 up to and including 3.95.x. | ||||
| CVE-2026-97665 October 15, 2026 | High 7.1 CVSS 4.0 7.1, rated by Sonatype (CNA) | no NVD data | no | Predates the affected range (from 3.95.0). |
Ranges and sources for CVE-2026-97665NVD has published no version configuration for this record (NVD status: Awaiting Analysis). Sonatype: Nexus Repository 3 CE/Pro versions 3.95.0 through 3.96.x. | ||||
| CVE-2026-14504 July 14, 2026 | Medium 6.5 CVSS 3.1 6.5, rated by NVD | no | no | Predates the affected range (from 3.88.0). |
Ranges and sources for CVE-2026-14504NVD configuration (NVD status: Analyzed): from 3.88.0 (including), before 3.94.0. Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions with Terraform hosted repositories (3.88.0+), Swift hosted repositories (3.89.0+), or Conda hosted repositories (3.91.0+), up to and including 3.93.x. | ||||
| CVE-2026-77121 September 2, 2026 | Medium 6.5 CVSS 3.1 6.5, rated by NVD | no | no | Predates the affected range (from 3.26.0). |
Ranges and sources for CVE-2026-77121NVD configuration (NVD status: Analyzed): from 3.26.0 (including), before 3.95.0. Sonatype: Nexus Repository 3 CE/Pro versions 3.26 through 3.94.x. | ||||
| CVE-2021-29159 April 28, 2021 | Medium 6.1 CVSS 3.1 6.1, rated by NVD | no | no | Predates the affected range (from 3.23.0). |
Ranges and sources for CVE-2021-29159NVD configuration (NVD status: Modified): from 3.23.0 (including), before 3.30.1. Sonatype: All Nexus Repository Manager 3 OSS/Pro versions between 3.23 and 3.30. | ||||
| CVE-2026-17596 August 7, 2026 | Medium 6.1 CVSS 3.1 6.1, rated by NVD | no | no | Predates the affected range (from 3.16.0). |
Ranges and sources for CVE-2026-17596NVD configuration (NVD status: Analyzed): from 3.16.0 (including), before 3.95.0. Sonatype: Sonatype Nexus Repository 3 CE/Pro versions 3.16.0 through 3.94.x. | ||||
| CVE-2019-14469 August 22, 2019 | Medium 5.4 CVSS 3.0 5.4, rated by NVD | no | no | Predates the affected range (from 3.14.0). |
Ranges and sources for CVE-2019-14469NVD configuration (NVD status: Modified): from 3.14.0 (including), through 3.17.0. Sonatype: Nexus Repository 3 versions starting in 3.14.0 up to and including 3.17.0. | ||||
| CVE-2026-7308 May 11, 2026 | Medium 5.4 CVSS 3.1 5.4, rated by NVD | no | no | Predates the affected range (from 3.6.0). |
Ranges and sources for CVE-2026-7308NVD configuration (NVD status: Analyzed): from 3.6.0 (including), before 3.93.0. Sonatype: Sonatype Nexus Repository 3.6.0 through 3.91.x (CE/Pro). | ||||
| CVE-2025-13488 December 4, 2025 | Medium 5.1 CVSS 4.0 5.1, rated by Sonatype (CNA) | no NVD data | no | Predates the affected range (from 3.83.0). |
Ranges and sources for CVE-2025-13488NVD has published no version configuration for this record (NVD status: Deferred). Sonatype: Sonatype Nexus Repository 3.x CE/Pro versions 3.83.0 through 3.86.2. | ||||
| CVE-2026-0601 January 14, 2026 | Medium 5.1 CVSS 4.0 5.1, rated by Sonatype (CNA) | no NVD data | no | Predates the affected range (from 3.82.0). |
Ranges and sources for CVE-2026-0601NVD has published no version configuration for this record (NVD status: Deferred). Sonatype: Sonatype Nexus Repository 3.82.0 through 3.87.1 (CE/Pro). | ||||
| CVE-2026-97667 October 15, 2026 | Medium 5.1 CVSS 4.0 5.1, rated by Sonatype (CNA) | no NVD data | no | Predates the affected range (from 3.28.0). |
Ranges and sources for CVE-2026-97667NVD has published no version configuration for this record (NVD status: Awaiting Analysis). Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.28.0 up to, but not including, 3.97.0. | ||||
| CVE-2026-17598 August 7, 2026 | Medium 4.9 CVSS 3.1 4.9, rated by NVD | no | no | Predates the affected range (from 3.91.0). |
Ranges and sources for CVE-2026-17598NVD configuration (NVD status: Analyzed): from 3.91.0 (including), before 3.95.0. Sonatype: Sonatype Nexus Repository 3 CE/Pro versions 3.91.0 through 3.94.x. | ||||
| CVE-2026-77122 September 2, 2026 | Medium 4.3 CVSS 3.1 4.3, rated by NVD | no | no | Predates the affected range (from 3.38.0). |
Ranges and sources for CVE-2026-77122NVD configuration (NVD status: Analyzed): from 3.38.0 (including), before 3.96.0. Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.38.0 up to (but not including) 3.96.0. | ||||
| CVE-2026-17595 August 7, 2026 | Low 2.7 CVSS 3.1 2.7, rated by NVD | no | no | Predates the affected range (from 3.15.0). |
Ranges and sources for CVE-2026-17595NVD configuration (NVD status: Analyzed): from 3.15.0 (including), before 3.95.0. Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions from 3.15.0 up to and including 3.94.x. | ||||
Sources and method
NVD's count evaluates NVD's published version ranges against this version; those ranges do not carry Sonatype's per-branch fixes, so the NVD column can read the same on either side of a fix that Sonatype names. Where NVD has not analyzed a record, the row reads "no NVD data", not "no".
3.5.0 carries the same 49 known CVEs as 8 other Sonatype Nexus Repository releases: 3.2.0, 3.2.1, 3.3.0, 3.3.1, 3.3.2, 3.4.0, 3.5.1, 3.5.2.
Sonatype's policy: Sonatype Nexus Repository releases are considered generally available and fully supported for a term of 1 year after the version's release date. Sonatype provides extended maintenance for each Sonatype Nexus Repository version for an additional 6 months before that version is considered sunset.
Sources: NVD (exact CPE match and the published configurations), the CVE Program record (the vendor's CNA entry with its affected and fixed versions), Sonatype's security advisories, release notes and end-of-life page. Pulled October 23, 2026. Every CVE row links to its NVD record and to the vendor's advisory.