Nexus 3.90.3 31 known CVEs

Support status: General Availability. General availability ends March 5, 2027. Sunset on September 5, 2027.

From Sonatype's published support dates.

Sonatype Nexus Repository 3.90.3
From Sonatype's release notes and support dates, and NVD
  1. Released April 8, 2026
  2. Support status General Availability
  3. General availability ends March 5, 2027
  4. Sunset on September 5, 2027
  5. Latest release 3.97.2, October 23, 2026
  6. Behind latest 198 days
  7. Lowest upgrade that fixes 30 of 31 3.97.0
  8. High 14 Medium 14 Low 3
Known CVEs 31
The same 31 as 9 other releases, listed under the table

A lookup, not a scan of your server. 27 of the 31 come from NVD's exact CPE match, and 4 more from Sonatype's advisories that NVD has not analyzed. Pulled October 23, 2026. Sources and method

Tired of patching Nexus yourself?

This is what we do. We host your Maven, npm, PyPI and Docker repositories, so there's no Nexus server to upgrade or patch.

Our migration tool, free to use with CloudRepo, moves your hosted repositories over from Nexus 3 and checks every file.

Start free trial

14 days free. No credit card required.

Or book a call with Chris

Upgrade path

3.97.0 fixes 30 of these 31. For the 31st (CVE-2026-0600), Sonatype publishes a workaround, not a fix.

No known security breaches in our history.

The 31 CVEs that affect 3.90.3

Sorted by severity. A CVE counts when either NVD or Sonatype says this version is affected; both verdicts are shown. Latest release: 3.97.2.

CVEs that affect Sonatype Nexus Repository 3.90.3
CVE Severity NVD Sonatype Fix
CVE-2026-17600 August 7, 2026 High 8.8 CVSS 3.1 8.8, rated by NVD yes yes 3.95.0 nearest fix; none on your branch
Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed.

A user whose account was already logged in at the time of one of these actions could continue using their existing session to interact with the repository as though the account were still active, until that session independently expired. Depending on the permissions previously held, this could allow continued unauthorized access to read, modify, or delete repository content after access was intended to be revoked.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.95.0.

Sonatype: All Sonatype Nexus Repository CE/Pro versions prior to 3.95.0.

NVD record Sonatype advisory

CVE-2026-17603 August 7, 2026 High 8.8 CVSS 3.1 8.8, rated by NVD yes yes 3.95.0 nearest fix; none on your branch
Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API.

A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user.

NVD configuration (NVD status: Analyzed): from 3.20.0 (including), before 3.95.0.

Sonatype: All Nexus Repository 3 CE/Pro versions from 3.20.0 up to and including 3.94.x.

NVD record Sonatype advisory

CVE-2026-3199 April 8, 2026 High 8.8 CVSS 3.1 8.8, rated by NVD yes yes 3.91.0 nearest fix; none on your branch
A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.

NVD configuration (NVD status: Analyzed): from 3.22.1 (including), before 3.91.0.

Sonatype: Sonatype Nexus Repository 3.22.1 through 3.90.x (CE/Pro).

NVD record Sonatype advisory

CVE-2026-97712 October 15, 2026 High 8.7 CVSS 4.0 8.7, rated by Sonatype (CNA) no NVD data yes 3.97.0 nearest fix; none on your branch
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold.

This can give the user more access than intended, up to full administrative access.

NVD has published no version configuration for this record (NVD status: Awaiting Analysis).

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.0.0 up to and including 3.96.4.

NVD record Sonatype advisory

CVE-2026-14646 July 14, 2026 High 7.7 CVSS 3.1 7.7, rated by NVD yes yes 3.94.0 nearest fix; none on your branch
Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers.

Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server - including an anonymous user, if anonymous access is enabled - could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.94.0.

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.0.0 up to and including 3.93.x.

NVD record Sonatype advisory

CVE-2026-11403 July 14, 2026 High 7.5 CVSS 3.1 7.5, rated by NVD yes yes 3.93.0 nearest fix; none on your branch
A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user.

A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.93.0.

Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions before 3.93.0.

NVD record Sonatype advisory

CVE-2026-3329 June 11, 2026 High 7.5 CVSS 3.1 7.5, rated by NVD yes yes 3.93.0 nearest fix; none on your branch
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.93.0.

Sonatype: All Sonatype Nexus Repository versions from 3.0.0 up to and including 3.92.x.

NVD record Sonatype advisory

CVE-2026-10748 June 16, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD yes yes 3.92.0 nearest fix; none on your branch
An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.92.0.

Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions before 3.92.0.

NVD record Sonatype advisory

CVE-2026-14644 August 7, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD yes yes 3.95.0 nearest fix; none on your branch
Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API.

An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint.

NVD configuration (NVD status: Analyzed): from 3.19.0 (including), before 3.95.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions 3.19.0 through 3.94.x.

NVD record Sonatype advisory

CVE-2026-17593 August 7, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD yes yes 3.95.0 nearest fix; none on your branch
An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permission in the legacy Nexus Repository 2) could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of registered realms.

Because unrecognized entries were persisted and re-evaluated on every realm load via a legacy code path, this could result in unintended code executing inside the Nexus Repository process, and in some cases a persistent authentication lockout that was not visible through the administrative UI.

NVD configuration (NVD status: Analyzed): from 2.8.0 (including), before 3.95.0.

Sonatype: All previous Sonatype Nexus Repository CE/Pro versions from 2.8.0 up to and including 3.94.x.

NVD record Sonatype advisory

CVE-2026-17599 August 7, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD yes yes 3.95.0 nearest fix; none on your branch
Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding.

This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result, an account holding the nexus:* permission could invoke the endpoint outside the intended onboarding flow to replace the administrator password, and existing sessions were not invalidated after the change.

NVD configuration (NVD status: Analyzed): from 3.17.0 (including), before 3.95.0.

Sonatype: All previous Nexus Repository 3 CE/Pro versions from 3.17.0 up to and including 3.94.x.

NVD record Sonatype advisory

CVE-2026-17601 August 7, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD yes yes 3.95.0 nearest fix; none on your branch
A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment.

NVD configuration (NVD status: Analyzed): from 3.19.0 (including), before 3.95.0.

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.19.0 through 3.94.x.

NVD record Sonatype advisory

CVE-2026-77124 September 2, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD yes yes 3.96.0 nearest fix; none on your branch
In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled.

An account holding script-execution permission could continue to run previously-created scripts even after an administrator set nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.

NVD configuration (NVD status: Analyzed): from 3.21.2 (including), before 3.96.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions from 3.21.2 up to and including 3.95.x.

NVD record Sonatype advisory

CVE-2026-77125 September 2, 2026 High 7.1 CVSS 3.1 7.1, rated by NVD yes yes 3.96.0 nearest fix; none on your branch
A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check.

A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing blobstore into a group blobstore, an action that should require the nexus:blobstores:update permission instead. This could result in unauthorized modification of blobstore configuration without administrator approval. The nexus:blobstores:create permission is a named permission that must be explicitly granted by an administrator; it is not held by default.

NVD configuration (NVD status: Analyzed): from 3.19.0 (including), before 3.96.0.

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.19.0 up to and including 3.95.x.

NVD record Sonatype advisory

CVE-2026-97666 October 15, 2026 Medium 6.9 CVSS 4.0 6.9, rated by Sonatype (CNA) no NVD data yes 3.97.0 nearest fix; none on your branch
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint.

This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.

NVD has published no version configuration for this record (NVD status: Awaiting Analysis).

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions up to and including 3.96.x.

NVD record Sonatype advisory

CVE-2026-14504 July 14, 2026 Medium 6.5 CVSS 3.1 6.5, rated by NVD yes yes 3.94.0 nearest fix; none on your branch
An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended write-permission check.

NVD configuration (NVD status: Analyzed): from 3.88.0 (including), before 3.94.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions with Terraform hosted repositories (3.88.0+), Swift hosted repositories (3.89.0+), or Conda hosted repositories (3.91.0+), up to and including 3.93.x.

NVD record Sonatype advisory

CVE-2026-77121 September 2, 2026 Medium 6.5 CVSS 3.1 6.5, rated by NVD yes yes 3.95.0 nearest fix; none on your branch
A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field.

This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only the targeted repository is affected; other repositories and overall server health remain unaffected.

NVD configuration (NVD status: Analyzed): from 3.26.0 (including), before 3.95.0.

Sonatype: Nexus Repository 3 CE/Pro versions 3.26 through 3.94.x.

NVD record Sonatype advisory

CVE-2026-77123 September 2, 2026 Medium 6.5 CVSS 3.1 6.5, rated by NVD yes yes 3.96.0 nearest fix; none on your branch
Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API.

An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. This issue affects Nexus Repository 3 versions 3.2.0 through 3.95.x, and is fixed in version 3.96.0.

NVD configuration (NVD status: Analyzed): from 3.2.0 (including), before 3.96.0.

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.2.0 up to and including 3.95.x.

NVD record Sonatype advisory

CVE-2026-0600 January 14, 2026 Medium 6.2 CVSS 4.0 6.2, rated by Sonatype (CNA) no NVD data yes No fixed version. Sonatype names a workaround from Sonatype Nexus Repository 3.88.0 (CE/Pro).
Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators to configure proxy repositories with URLs that can access unintended network destinations, potentially including cloud metadata services and internal network resources.

A workaround configuration is available starting in version 3.88.0, but the product remains vulnerable by default.

NVD has published no version configuration for this record (NVD status: Deferred).

Sonatype: Sonatype Nexus Repository 3.0.0 and later (CE/Pro).

NVD record Sonatype advisory

CVE-2026-17596 August 7, 2026 Medium 6.1 CVSS 3.1 6.1, rated by NVD yes yes 3.95.0 nearest fix; none on your branch
Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS).

A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system health-check status. This issue has been fixed in version 3.95.0.

NVD configuration (NVD status: Analyzed): from 3.16.0 (including), before 3.95.0.

Sonatype: Sonatype Nexus Repository 3 CE/Pro versions 3.16.0 through 3.94.x.

NVD record Sonatype advisory

CVE-2026-3438 April 8, 2026 Medium 6.1 CVSS 3.1 6.1, rated by NVD yes yes 3.91.0 nearest fix; none on your branch
A reflected cross-site scripting vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2 that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL.

Exploitation requires user interaction.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.91.0.

Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions up to and including 3.90.x.

NVD record Sonatype advisory

CVE-2026-14645 July 14, 2026 Medium 5.5 CVSS 3.1 5.5, rated by NVD yes yes 3.94.0 nearest fix; none on your branch
Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations (Server-Side Request Forgery).

This permission is granted by role assignment, independent of authentication status, so an unauthenticated user could also trigger this behavior if the anonymous role has been granted the permission.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.94.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions up to and including 3.93.x.

NVD record Sonatype advisory

CVE-2026-7308 May 11, 2026 Medium 5.4 CVSS 3.1 5.4, rated by NVD yes yes 3.92.0 nearest fix; none on your branch
An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0.

This could allow the attacker to perform actions in the context of the victim's session.

NVD configuration (NVD status: Analyzed): from 3.6.0 (including), before 3.93.0.

Sonatype: Sonatype Nexus Repository 3.6.0 through 3.91.x (CE/Pro).

NVD record Sonatype advisory

CVE-2026-97667 October 15, 2026 Medium 5.1 CVSS 4.0 5.1, rated by Sonatype (CNA) no NVD data yes 3.97.0 nearest fix; none on your branch
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package.

The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the permissions of the viewing user. In this description, a user account means an account that has supplied valid credentials. The anonymous user, if enabled, is also a user account and can hold this permission if an administrator grants it.

NVD has published no version configuration for this record (NVD status: Awaiting Analysis).

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.28.0 up to, but not including, 3.97.0.

NVD record Sonatype advisory

CVE-2026-7494 July 14, 2026 Medium 5.0 CVSS 3.1 5.0, rated by NVD yes yes 3.94.0 nearest fix; none on your branch
Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint.

A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects Nexus Repository 3.0.0 through versions prior to 3.94.0.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.94.0.

Sonatype: Sonatype Nexus Repository 3 CE/Pro versions 3.0.0 up to and including 3.93.x.

NVD record Sonatype advisory

CVE-2026-10741 June 17, 2026 Medium 4.9 CVSS 3.1 4.9, rated by NVD yes yes 3.93.0 nearest fix; none on your branch
Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configuration that allows a delegated repository administrator to disclose stored upstream proxy credentials.

NVD configuration (NVD status: Analyzed): from 3.1.0 (including), before 3.93.0.

Sonatype: All Sonatype Nexus Repository 3.x versions from 3.1.0 through 3.92.x.

NVD record Sonatype advisory

CVE-2026-17594 August 7, 2026 Medium 4.9 CVSS 3.1 4.9, rated by NVD yes yes 3.95.0 nearest fix; none on your branch
Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface.

An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.95.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x.

NVD record Sonatype advisory

CVE-2026-77122 September 2, 2026 Medium 4.3 CVSS 3.1 4.3, rated by NVD yes yes 3.96.0 nearest fix; none on your branch
An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Repository 3 allowed an account holding read or browse permission on a group repository to retrieve metadata for member repositories on which it held no direct permission, by…

requesting the endpoint directly for the member repository name. For proxy repositories, the disclosed metadata includes the configured remote URL, which may reveal internal upstream hostnames. This includes the anonymous user if it has been granted this permission; whether the anonymous user holds this permission depends on the role and permission configuration of the specific installation.

NVD configuration (NVD status: Analyzed): from 3.38.0 (including), before 3.96.0.

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.38.0 up to (but not including) 3.96.0.

NVD record Sonatype advisory

CVE-2026-3048 May 11, 2026 Low 3.8 CVSS 3.1 3.8, rated by NVD yes yes 3.92.0 nearest fix; none on your branch
An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiate unintended server-side connections when interacting with a malicious LDAP server.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.92.0.

Sonatype: Sonatype Nexus Repository 3.0.0 through 3.91.x (CE/Pro).

NVD record Sonatype advisory

CVE-2026-17595 August 7, 2026 Low 2.7 CVSS 3.1 2.7, rated by NVD yes yes 3.95.0 nearest fix; none on your branch
Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors.

An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata such as class and classloader names. This issue does not permit method invocation, object construction, or arbitrary code execution. This has been fixed by restricting property access in the JEXL sandbox to the intended data types.

NVD configuration (NVD status: Analyzed): from 3.15.0 (including), before 3.95.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions from 3.15.0 up to and including 3.94.x.

NVD record Sonatype advisory

CVE-2026-17597 August 7, 2026 Low 2.7 CVSS 3.1 2.7, rated by NVD yes yes 3.95.0 nearest fix; none on your branch
Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) vulnerability in the email configuration verification feature.

A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt outbound network connections to internal or otherwise restricted network addresses. Differences in the server's response could be used to infer whether internal hosts and ports are reachable. This issue affects Nexus Repository 3 CE/Pro versions up to and including 3.94.1, and is fixed in version 3.95.0.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.95.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions up to and including 3.94.x.

NVD record Sonatype advisory

39 other Sonatype Nexus Repository CVEs on record that do not affect 3.90.3

Each of these is fixed at or before 3.90.3 on its branch, or its published range does not include this version.

Sonatype Nexus Repository CVEs on record that do not affect 3.90.3
CVE Severity NVD Sonatype Fix
CVE-2019-7238 March 21, 2019 Critical 9.8 CVSS 3.1 9.8, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2019-7238

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.15.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2019-9629 July 8, 2019 Critical 9.8 CVSS 3.0 9.8, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2019-9629

NVD configuration (NVD status: Modified): before 3.17.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2026-5189 April 15, 2026 Critical 9.8 CVSS 3.1 9.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-5189

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.71.0.

Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions 3.0.0 through 3.70.5.

NVD record Sonatype advisory

CVE-2020-10199 April 1, 2020 High 8.8 CVSS 3.1 8.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2020-10199

NVD configuration (NVD status: Analyzed): before 3.21.2.

Sonatype: All previous Nexus Repository 3.x OSS/Pro versions up to and including 3.21.1.

NVD record Sonatype advisory

CVE-2020-11444 April 2, 2020 High 8.8 CVSS 3.1 8.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2020-11444

NVD configuration (NVD status: Modified): from 3.0.0 (including), through 3.21.2.

Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.21.2.

NVD record Sonatype advisory

CVE-2020-11753 April 20, 2020 High 8.8 CVSS 3.1 8.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2020-11753

NVD configuration (NVD status: Analyzed): exactly 3.21.1; exactly 3.22.0.

Sonatype: Nexus Repository 3 OSS/Pro versions 3.21.1 and 3.22.0.

NVD record Sonatype advisory

CVE-2020-15871 July 31, 2020 High 8.8 CVSS 3.1 8.8, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2020-15871

NVD configuration (NVD status: Analyzed): before 3.25.1.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2021-40143 September 7, 2021 High 8.2 CVSS 3.1 8.2, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-40143

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.34.1-01.

Sonatype: Nexus Repository 3 versions up to and including 3.33.1.

NVD record Sonatype advisory

CVE-2018-16620 November 15, 2018 High 7.5 CVSS 3.0 7.5, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2018-16620

NVD configuration (NVD status: Modified): before 3.14.0.

Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.13.0.

NVD record Sonatype advisory

CVE-2019-9630 July 8, 2019 High 7.5 CVSS 3.0 7.5, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2019-9630

NVD configuration (NVD status: Modified): before 3.17.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2020-15868 August 12, 2020 High 7.5 CVSS 3.1 7.5, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2020-15868

NVD configuration (NVD status: Modified): before 3.26.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2024-4956 May 16, 2024 High 7.5 CVSS 3.1 7.5, rated by Sonatype (CNA) no NVD data no Outside the affected range.
Ranges and sources for CVE-2024-4956

NVD has published no version configuration for this record (NVD status: Deferred).

Sonatype: All previous Sonatype Nexus Repository 3.x OSS/Pro versions up to and including 3.68.0.

NVD record Sonatype advisory

CVE-2018-16621 November 15, 2018 High 7.2 CVSS 3.1 7.2, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2018-16621

NVD configuration (NVD status: Modified): before 3.14.0.

Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.13.0.

NVD record Sonatype advisory

CVE-2019-16530 October 21, 2019 High 7.2 CVSS 3.1 7.2, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2019-16530

NVD configuration (NVD status: Modified): from 2.0.0 (including), through 2.14.14; from 3.0.0 (including), through 3.18.1.

Sonatype: Nexus Repository 2 versions up to and including 2.14.14; Nexus Repository 3 versions up to and including 3.18.1; IQ Server versions up to and including 72.

NVD record Sonatype advisory

CVE-2020-10204 April 1, 2020 High 7.2 CVSS 3.1 7.2, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2020-10204

NVD configuration (NVD status: Modified): before 3.21.2.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2026-97665 October 15, 2026 High 7.1 CVSS 4.0 7.1, rated by Sonatype (CNA) no NVD data no Predates the affected range (from 3.95.0).
Ranges and sources for CVE-2026-97665

NVD has published no version configuration for this record (NVD status: Awaiting Analysis).

Sonatype: Nexus Repository 3 CE/Pro versions 3.95.0 through 3.96.x.

NVD record Sonatype advisory

CVE-2020-29436 December 17, 2020 Medium 6.5 CVSS 3.1 6.5, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2020-29436

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.29.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2024-5764 October 23, 2024 Medium 6.5 CVSS 3.1 6.5, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2024-5764

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.73.0.

Sonatype: All previous Sonatype Nexus Repository Manager 3.x OSS/Pro versions up to and including 3.72.0.

NVD record Sonatype advisory

CVE-2018-16619 November 15, 2018 Medium 6.1 CVSS 3.0 6.1, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2018-16619

NVD configuration (NVD status: Modified): before 3.14.0.

Sonatype: All previous Nexus Repository Manager 3 OSS/Pro versions up to and including 3.13.0.

NVD record Sonatype advisory

CVE-2018-5306 February 9, 2018 Medium 6.1 CVSS 3.0 6.1, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2018-5306

NVD configuration (NVD status: Modified): from 3.0 (including), before 3.8.

Sonatype: All previous 3.x Nexus Repository OSS/Pro versions up to and including 3.7.1.

NVD record Sonatype advisory

CVE-2020-15870 July 31, 2020 Medium 6.1 CVSS 3.1 6.1, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2020-15870

NVD configuration (NVD status: Analyzed): before 3.25.1.

Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.25.0.

NVD record Sonatype advisory

CVE-2021-29159 April 28, 2021 Medium 6.1 CVSS 3.1 6.1, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-29159

NVD configuration (NVD status: Modified): from 3.23.0 (including), before 3.30.1.

Sonatype: All Nexus Repository Manager 3 OSS/Pro versions between 3.23 and 3.30.

NVD record Sonatype advisory

CVE-2019-14469 August 22, 2019 Medium 5.4 CVSS 3.0 5.4, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2019-14469

NVD configuration (NVD status: Modified): from 3.14.0 (including), through 3.17.0.

Sonatype: Nexus Repository 3 versions starting in 3.14.0 up to and including 3.17.0.

NVD record Sonatype advisory

CVE-2020-15869 July 31, 2020 Medium 5.4 CVSS 3.1 5.4, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2020-15869

NVD configuration (NVD status: Analyzed): before 3.25.1.

Sonatype: All previous Nexus Repository Manager 3 OSS/Pro versions up to and including 3.25.0.

NVD record Sonatype advisory

CVE-2021-37152 August 10, 2021 Medium 5.4 CVSS 3.1 5.4, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-37152

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.33.0.

Sonatype: Nexus Repository 3 versions up to and including 3.32.0.

NVD record Sonatype advisory

CVE-2021-30635 April 27, 2021 Medium 5.3 CVSS 3.1 5.3, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-30635

NVD configuration (NVD status: Modified): from 3.0 (including), before 3.30.1.

Sonatype: Nexus Repository Manager 3 versions up to and including 3.30.0.

NVD record Sonatype advisory

CVE-2025-13488 December 4, 2025 Medium 5.1 CVSS 4.0 5.1, rated by Sonatype (CNA) no NVD data no Outside the affected range.
Ranges and sources for CVE-2025-13488

NVD has published no version configuration for this record (NVD status: Deferred).

Sonatype: Sonatype Nexus Repository 3.x CE/Pro versions 3.83.0 through 3.86.2.

NVD record Sonatype advisory

CVE-2026-0601 January 14, 2026 Medium 5.1 CVSS 4.0 5.1, rated by Sonatype (CNA) no NVD data no Outside the affected range.
Ranges and sources for CVE-2026-0601

NVD has published no version configuration for this record (NVD status: Deferred).

Sonatype: Sonatype Nexus Repository 3.82.0 through 3.87.1 (CE/Pro).

NVD record Sonatype advisory

CVE-2020-11415 April 27, 2020 Medium 4.9 CVSS 3.1 4.9, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2020-11415

NVD configuration (NVD status: Modified): from 2.0 (including), before 2.14.17; from 3.0 (including), before 3.22.1.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2020-24622 August 25, 2020 Medium 4.9 CVSS 3.1 4.9, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2020-24622

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.27.0.

Sonatype: Nexus Repository 3 versions up to and including 3.26.1.

NVD record Sonatype advisory

CVE-2021-29158 April 23, 2021 Medium 4.9 CVSS 3.1 4.9, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-29158

NVD configuration (NVD status: Analyzed): through 3.30.0.

Sonatype: Nexus Repository Manager 3 Pro versions up to and including 3.30.0.

NVD record Sonatype advisory

CVE-2026-17598 August 7, 2026 Medium 4.9 CVSS 3.1 4.9, rated by NVD no no Predates the affected range (from 3.91.0).
Ranges and sources for CVE-2026-17598

NVD configuration (NVD status: Analyzed): from 3.91.0 (including), before 3.95.0.

Sonatype: Sonatype Nexus Repository 3 CE/Pro versions 3.91.0 through 3.94.x.

NVD record Sonatype advisory

CVE-2018-12100 June 11, 2018 Medium 4.8 CVSS 3.0 4.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2018-12100

NVD configuration (NVD status: Modified): from 3.3.0 (including), before 3.12.0.

Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.11.0-01..

NVD record Sonatype advisory

CVE-2020-10203 April 1, 2020 Medium 4.8 CVSS 3.1 4.8, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2020-10203

NVD configuration (NVD status: Modified): before 3.21.2.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2021-34553 June 18, 2021 Medium 4.3 CVSS 3.1 4.3, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-34553

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.31.0.

Sonatype: Nexus Repository 3 versions up to and including 3.30.1.

NVD record Sonatype advisory

CVE-2021-42568 November 2, 2021 Medium 4.3 CVSS 3.1 4.3, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2021-42568

NVD configuration (NVD status: Modified): from 3.0.0 (including), through 3.35.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2021-43293 November 4, 2021 Medium 4.3 CVSS 3.1 4.3, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2021-43293

NVD configuration (NVD status: Modified): from 3.0.0 (including), through 3.35.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2021-43961 March 17, 2022 Medium 4.3 CVSS 3.1 4.3, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-43961

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.38.0.

Sonatype: Nexus Repository 3 versions up to and including 3.37.3.

NVD record Sonatype advisory

CVE-2022-27907 March 30, 2022 Medium 4.3 CVSS 3.1 4.3, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2022-27907

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.38.0.

Sonatype: Nexus Repository 3 versions up to and including 3.37.3.

NVD record Sonatype advisory

Sources and method

NVD's count evaluates NVD's published version ranges against this version; those ranges do not carry Sonatype's per-branch fixes, so the NVD column can read the same on either side of a fix that Sonatype names. Where NVD has not analyzed a record, the row reads "no NVD data", not "no".

3.90.3 carries the same 31 known CVEs as 9 other Sonatype Nexus Repository releases: 3.88.0, 3.88.1, 3.89.0, 3.89.1, 3.90.0, 3.90.1, 3.90.2, 3.90.4, 3.90.5.

Sonatype's policy: Sonatype Nexus Repository releases are considered generally available and fully supported for a term of 1 year after the version's release date. Sonatype provides extended maintenance for each Sonatype Nexus Repository version for an additional 6 months before that version is considered sunset.

Sources: NVD (exact CPE match and the published configurations), the CVE Program record (the vendor's CNA entry with its affected and fixed versions), Sonatype's security advisories, release notes and end-of-life page. Pulled October 23, 2026. Every CVE row links to its NVD record and to the vendor's advisory.

Next