Nexus 3.95.4 9 known CVEs
Support status: General Availability. General availability ends August 5, 2027. Sunset on February 5, 2028.
From Sonatype's published support dates.
- Released September 12, 2026
- Support status General Availability
- General availability ends August 5, 2027
- Sunset on February 5, 2028
- Latest release 3.97.2, October 23, 2026
- Behind latest 41 days
- Lowest upgrade that fixes 8 of 9 3.97.0
- High 4 Medium 5
A lookup, not a scan of your server. 4 of the 9 come from NVD's exact CPE match, and 5 more from Sonatype's advisories that NVD has not analyzed. Pulled October 23, 2026. Sources and method
Tired of patching Nexus yourself?
This is what we do. We host your Maven, npm, PyPI and Docker repositories, so there's no Nexus server to upgrade or patch.
Our migration tool, free to use with CloudRepo, moves your hosted repositories over from Nexus 3 and checks every file.
Upgrade path
3.97.0 fixes 8 of these 9. For the 9th (CVE-2026-0600), Sonatype publishes a workaround, not a fix.
No known security breaches in our history.
The 9 CVEs that affect 3.95.4
Sorted by severity. A CVE counts when either NVD or Sonatype says this version is affected; both verdicts are shown. Latest release: 3.97.2.
| CVE | Severity | NVD | Sonatype | Fix |
|---|---|---|---|---|
| CVE-2026-97712 October 15, 2026 | High 8.7 CVSS 4.0 8.7, rated by Sonatype (CNA) | no NVD data | yes | 3.97.0 nearest fix; none on your branch |
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold.This can give the user more access than intended, up to full administrative access. NVD has published no version configuration for this record (NVD status: Awaiting Analysis). Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.0.0 up to and including 3.96.4. | ||||
| CVE-2026-77124 September 2, 2026 | High 7.2 CVSS 3.1 7.2, rated by NVD | yes | yes | 3.96.0 nearest fix; none on your branch |
In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled.An account holding script-execution permission could continue to run previously-created scripts even after an administrator set nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution. NVD configuration (NVD status: Analyzed): from 3.21.2 (including), before 3.96.0. Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions from 3.21.2 up to and including 3.95.x. | ||||
| CVE-2026-77125 September 2, 2026 | High 7.1 CVSS 3.1 7.1, rated by NVD | yes | yes | 3.96.0 nearest fix; none on your branch |
A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check.A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing blobstore into a group blobstore, an action that should require the nexus:blobstores:update permission instead. This could result in unauthorized modification of blobstore configuration without administrator approval. The nexus:blobstores:create permission is a named permission that must be explicitly granted by an administrator; it is not held by default. NVD configuration (NVD status: Analyzed): from 3.19.0 (including), before 3.96.0. Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.19.0 up to and including 3.95.x. | ||||
| CVE-2026-97665 October 15, 2026 | High 7.1 CVSS 4.0 7.1, rated by Sonatype (CNA) | no NVD data | yes | 3.97.0 nearest fix; none on your branch |
A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing the write-permission check enforced for ordinary package uploads.Exploitation requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the built-in anonymous user holds read and browse privileges across all repositories by default, so this precondition can also be met without an authenticated account. NVD has published no version configuration for this record (NVD status: Awaiting Analysis). Sonatype: Nexus Repository 3 CE/Pro versions 3.95.0 through 3.96.x. | ||||
| CVE-2026-97666 October 15, 2026 | Medium 6.9 CVSS 4.0 6.9, rated by Sonatype (CNA) | no NVD data | yes | 3.97.0 nearest fix; none on your branch |
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint.This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution. NVD has published no version configuration for this record (NVD status: Awaiting Analysis). Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions up to and including 3.96.x. | ||||
| CVE-2026-77123 September 2, 2026 | Medium 6.5 CVSS 3.1 6.5, rated by NVD | yes | yes | 3.96.0 nearest fix; none on your branch |
Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API.An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. This issue affects Nexus Repository 3 versions 3.2.0 through 3.95.x, and is fixed in version 3.96.0. NVD configuration (NVD status: Analyzed): from 3.2.0 (including), before 3.96.0. Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.2.0 up to and including 3.95.x. | ||||
| CVE-2026-0600 January 14, 2026 | Medium 6.2 CVSS 4.0 6.2, rated by Sonatype (CNA) | no NVD data | yes | No fixed version. Sonatype names a workaround from Sonatype Nexus Repository 3.88.0 (CE/Pro). |
Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators to configure proxy repositories with URLs that can access unintended network destinations, potentially including cloud metadata services and internal network resources.A workaround configuration is available starting in version 3.88.0, but the product remains vulnerable by default. NVD has published no version configuration for this record (NVD status: Deferred). Sonatype: Sonatype Nexus Repository 3.0.0 and later (CE/Pro). | ||||
| CVE-2026-97667 October 15, 2026 | Medium 5.1 CVSS 4.0 5.1, rated by Sonatype (CNA) | no NVD data | yes | 3.97.0 nearest fix; none on your branch |
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package.The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the permissions of the viewing user. In this description, a user account means an account that has supplied valid credentials. The anonymous user, if enabled, is also a user account and can hold this permission if an administrator grants it. NVD has published no version configuration for this record (NVD status: Awaiting Analysis). Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.28.0 up to, but not including, 3.97.0. | ||||
| CVE-2026-77122 September 2, 2026 | Medium 4.3 CVSS 3.1 4.3, rated by NVD | yes | yes | 3.96.0 nearest fix; none on your branch |
An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Repository 3 allowed an account holding read or browse permission on a group repository to retrieve metadata for member repositories on which it held no direct permission, by…requesting the endpoint directly for the member repository name. For proxy repositories, the disclosed metadata includes the configured remote URL, which may reveal internal upstream hostnames. This includes the anonymous user if it has been granted this permission; whether the anonymous user holds this permission depends on the role and permission configuration of the specific installation. NVD configuration (NVD status: Analyzed): from 3.38.0 (including), before 3.96.0. Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.38.0 up to (but not including) 3.96.0. | ||||
61 other Sonatype Nexus Repository CVEs on record that do not affect 3.95.4
Each of these is fixed at or before 3.95.4 on its branch, or its published range does not include this version.
| CVE | Severity | NVD | Sonatype | Fix |
|---|---|---|---|---|
| CVE-2019-7238 March 21, 2019 | Critical 9.8 CVSS 3.1 9.8, rated by NVD | no | no Sonatype CNA range | NVD's published range does not include this version. |
Ranges and sources for CVE-2019-7238NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.15.0. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2019-9629 July 8, 2019 | Critical 9.8 CVSS 3.0 9.8, rated by NVD | no | no Sonatype CNA range | NVD's published range does not include this version. |
Ranges and sources for CVE-2019-9629NVD configuration (NVD status: Modified): before 3.17.0. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2026-5189 April 15, 2026 | Critical 9.8 CVSS 3.1 9.8, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2026-5189NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.71.0. Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions 3.0.0 through 3.70.5. | ||||
| CVE-2020-10199 April 1, 2020 | High 8.8 CVSS 3.1 8.8, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2020-10199NVD configuration (NVD status: Analyzed): before 3.21.2. Sonatype: All previous Nexus Repository 3.x OSS/Pro versions up to and including 3.21.1. | ||||
| CVE-2020-11444 April 2, 2020 | High 8.8 CVSS 3.1 8.8, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2020-11444NVD configuration (NVD status: Modified): from 3.0.0 (including), through 3.21.2. Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.21.2. | ||||
| CVE-2020-11753 April 20, 2020 | High 8.8 CVSS 3.1 8.8, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2020-11753NVD configuration (NVD status: Analyzed): exactly 3.21.1; exactly 3.22.0. Sonatype: Nexus Repository 3 OSS/Pro versions 3.21.1 and 3.22.0. | ||||
| CVE-2020-15871 July 31, 2020 | High 8.8 CVSS 3.1 8.8, rated by NVD | no | no Sonatype CNA range | NVD's published range does not include this version. |
Ranges and sources for CVE-2020-15871NVD configuration (NVD status: Analyzed): before 3.25.1. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2026-17600 August 7, 2026 | High 8.8 CVSS 3.1 8.8, rated by NVD | no | no | 3.95.0 already fixed in this version |
Ranges and sources for CVE-2026-17600NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.95.0. Sonatype: All Sonatype Nexus Repository CE/Pro versions prior to 3.95.0. | ||||
| CVE-2026-17603 August 7, 2026 | High 8.8 CVSS 3.1 8.8, rated by NVD | no | no | 3.95.0 already fixed in this version |
Ranges and sources for CVE-2026-17603NVD configuration (NVD status: Analyzed): from 3.20.0 (including), before 3.95.0. Sonatype: All Nexus Repository 3 CE/Pro versions from 3.20.0 up to and including 3.94.x. | ||||
| CVE-2026-3199 April 8, 2026 | High 8.8 CVSS 3.1 8.8, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2026-3199NVD configuration (NVD status: Analyzed): from 3.22.1 (including), before 3.91.0. Sonatype: Sonatype Nexus Repository 3.22.1 through 3.90.x (CE/Pro). | ||||
| CVE-2021-40143 September 7, 2021 | High 8.2 CVSS 3.1 8.2, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2021-40143NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.34.1-01. Sonatype: Nexus Repository 3 versions up to and including 3.33.1. | ||||
| CVE-2026-14646 July 14, 2026 | High 7.7 CVSS 3.1 7.7, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2026-14646NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.94.0. Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.0.0 up to and including 3.93.x. | ||||
| CVE-2018-16620 November 15, 2018 | High 7.5 CVSS 3.0 7.5, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2018-16620NVD configuration (NVD status: Modified): before 3.14.0. Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.13.0. | ||||
| CVE-2019-9630 July 8, 2019 | High 7.5 CVSS 3.0 7.5, rated by NVD | no | no Sonatype CNA range | NVD's published range does not include this version. |
Ranges and sources for CVE-2019-9630NVD configuration (NVD status: Modified): before 3.17.0. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2020-15868 August 12, 2020 | High 7.5 CVSS 3.1 7.5, rated by NVD | no | no Sonatype CNA range | NVD's published range does not include this version. |
Ranges and sources for CVE-2020-15868NVD configuration (NVD status: Modified): before 3.26.0. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2024-4956 May 16, 2024 | High 7.5 CVSS 3.1 7.5, rated by Sonatype (CNA) | no NVD data | no | Outside the affected range. |
Ranges and sources for CVE-2024-4956NVD has published no version configuration for this record (NVD status: Deferred). Sonatype: All previous Sonatype Nexus Repository 3.x OSS/Pro versions up to and including 3.68.0. | ||||
| CVE-2026-11403 July 14, 2026 | High 7.5 CVSS 3.1 7.5, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2026-11403NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.93.0. Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions before 3.93.0. | ||||
| CVE-2026-3329 June 11, 2026 | High 7.5 CVSS 3.1 7.5, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2026-3329NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.93.0. Sonatype: All Sonatype Nexus Repository versions from 3.0.0 up to and including 3.92.x. | ||||
| CVE-2018-16621 November 15, 2018 | High 7.2 CVSS 3.1 7.2, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2018-16621NVD configuration (NVD status: Modified): before 3.14.0. Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.13.0. | ||||
| CVE-2019-16530 October 21, 2019 | High 7.2 CVSS 3.1 7.2, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2019-16530NVD configuration (NVD status: Modified): from 2.0.0 (including), through 2.14.14; from 3.0.0 (including), through 3.18.1. Sonatype: Nexus Repository 2 versions up to and including 2.14.14; Nexus Repository 3 versions up to and including 3.18.1; IQ Server versions up to and including 72. | ||||
| CVE-2020-10204 April 1, 2020 | High 7.2 CVSS 3.1 7.2, rated by NVD | no | no Sonatype CNA range | NVD's published range does not include this version. |
Ranges and sources for CVE-2020-10204NVD configuration (NVD status: Modified): before 3.21.2. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2026-10748 June 16, 2026 | High 7.2 CVSS 3.1 7.2, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2026-10748NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.92.0. Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions before 3.92.0. | ||||
| CVE-2026-14644 August 7, 2026 | High 7.2 CVSS 3.1 7.2, rated by NVD | no | no | 3.95.0 already fixed in this version |
Ranges and sources for CVE-2026-14644NVD configuration (NVD status: Analyzed): from 3.19.0 (including), before 3.95.0. Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions 3.19.0 through 3.94.x. | ||||
| CVE-2026-17593 August 7, 2026 | High 7.2 CVSS 3.1 7.2, rated by NVD | no | no | 3.95.0 already fixed in this version |
Ranges and sources for CVE-2026-17593NVD configuration (NVD status: Analyzed): from 2.8.0 (including), before 3.95.0. Sonatype: All previous Sonatype Nexus Repository CE/Pro versions from 2.8.0 up to and including 3.94.x. | ||||
| CVE-2026-17599 August 7, 2026 | High 7.2 CVSS 3.1 7.2, rated by NVD | no | no | 3.95.0 already fixed in this version |
Ranges and sources for CVE-2026-17599NVD configuration (NVD status: Analyzed): from 3.17.0 (including), before 3.95.0. Sonatype: All previous Nexus Repository 3 CE/Pro versions from 3.17.0 up to and including 3.94.x. | ||||
| CVE-2026-17601 August 7, 2026 | High 7.2 CVSS 3.1 7.2, rated by NVD | no | no | 3.95.0 already fixed in this version |
Ranges and sources for CVE-2026-17601NVD configuration (NVD status: Analyzed): from 3.19.0 (including), before 3.95.0. Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.19.0 through 3.94.x. | ||||
| CVE-2020-29436 December 17, 2020 | Medium 6.5 CVSS 3.1 6.5, rated by NVD | no | no Sonatype CNA range | NVD's published range does not include this version. |
Ranges and sources for CVE-2020-29436NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.29.0. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2024-5764 October 23, 2024 | Medium 6.5 CVSS 3.1 6.5, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2024-5764NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.73.0. Sonatype: All previous Sonatype Nexus Repository Manager 3.x OSS/Pro versions up to and including 3.72.0. | ||||
| CVE-2026-14504 July 14, 2026 | Medium 6.5 CVSS 3.1 6.5, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2026-14504NVD configuration (NVD status: Analyzed): from 3.88.0 (including), before 3.94.0. Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions with Terraform hosted repositories (3.88.0+), Swift hosted repositories (3.89.0+), or Conda hosted repositories (3.91.0+), up to and including 3.93.x. | ||||
| CVE-2026-77121 September 2, 2026 | Medium 6.5 CVSS 3.1 6.5, rated by NVD | no | no | 3.95.0 already fixed in this version |
Ranges and sources for CVE-2026-77121NVD configuration (NVD status: Analyzed): from 3.26.0 (including), before 3.95.0. Sonatype: Nexus Repository 3 CE/Pro versions 3.26 through 3.94.x. | ||||
| CVE-2018-16619 November 15, 2018 | Medium 6.1 CVSS 3.0 6.1, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2018-16619NVD configuration (NVD status: Modified): before 3.14.0. Sonatype: All previous Nexus Repository Manager 3 OSS/Pro versions up to and including 3.13.0. | ||||
| CVE-2018-5306 February 9, 2018 | Medium 6.1 CVSS 3.0 6.1, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2018-5306NVD configuration (NVD status: Modified): from 3.0 (including), before 3.8. Sonatype: All previous 3.x Nexus Repository OSS/Pro versions up to and including 3.7.1. | ||||
| CVE-2020-15870 July 31, 2020 | Medium 6.1 CVSS 3.1 6.1, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2020-15870NVD configuration (NVD status: Analyzed): before 3.25.1. Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.25.0. | ||||
| CVE-2021-29159 April 28, 2021 | Medium 6.1 CVSS 3.1 6.1, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2021-29159NVD configuration (NVD status: Modified): from 3.23.0 (including), before 3.30.1. Sonatype: All Nexus Repository Manager 3 OSS/Pro versions between 3.23 and 3.30. | ||||
| CVE-2026-17596 August 7, 2026 | Medium 6.1 CVSS 3.1 6.1, rated by NVD | no | no | 3.95.0 already fixed in this version |
Ranges and sources for CVE-2026-17596NVD configuration (NVD status: Analyzed): from 3.16.0 (including), before 3.95.0. Sonatype: Sonatype Nexus Repository 3 CE/Pro versions 3.16.0 through 3.94.x. | ||||
| CVE-2026-3438 April 8, 2026 | Medium 6.1 CVSS 3.1 6.1, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2026-3438NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.91.0. Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions up to and including 3.90.x. | ||||
| CVE-2026-14645 July 14, 2026 | Medium 5.5 CVSS 3.1 5.5, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2026-14645NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.94.0. Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions up to and including 3.93.x. | ||||
| CVE-2019-14469 August 22, 2019 | Medium 5.4 CVSS 3.0 5.4, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2019-14469NVD configuration (NVD status: Modified): from 3.14.0 (including), through 3.17.0. Sonatype: Nexus Repository 3 versions starting in 3.14.0 up to and including 3.17.0. | ||||
| CVE-2020-15869 July 31, 2020 | Medium 5.4 CVSS 3.1 5.4, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2020-15869NVD configuration (NVD status: Analyzed): before 3.25.1. Sonatype: All previous Nexus Repository Manager 3 OSS/Pro versions up to and including 3.25.0. | ||||
| CVE-2021-37152 August 10, 2021 | Medium 5.4 CVSS 3.1 5.4, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2021-37152NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.33.0. Sonatype: Nexus Repository 3 versions up to and including 3.32.0. | ||||
| CVE-2026-7308 May 11, 2026 | Medium 5.4 CVSS 3.1 5.4, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2026-7308NVD configuration (NVD status: Analyzed): from 3.6.0 (including), before 3.93.0. Sonatype: Sonatype Nexus Repository 3.6.0 through 3.91.x (CE/Pro). | ||||
| CVE-2021-30635 April 27, 2021 | Medium 5.3 CVSS 3.1 5.3, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2021-30635NVD configuration (NVD status: Modified): from 3.0 (including), before 3.30.1. Sonatype: Nexus Repository Manager 3 versions up to and including 3.30.0. | ||||
| CVE-2025-13488 December 4, 2025 | Medium 5.1 CVSS 4.0 5.1, rated by Sonatype (CNA) | no NVD data | no | Outside the affected range. |
Ranges and sources for CVE-2025-13488NVD has published no version configuration for this record (NVD status: Deferred). Sonatype: Sonatype Nexus Repository 3.x CE/Pro versions 3.83.0 through 3.86.2. | ||||
| CVE-2026-0601 January 14, 2026 | Medium 5.1 CVSS 4.0 5.1, rated by Sonatype (CNA) | no NVD data | no | Outside the affected range. |
Ranges and sources for CVE-2026-0601NVD has published no version configuration for this record (NVD status: Deferred). Sonatype: Sonatype Nexus Repository 3.82.0 through 3.87.1 (CE/Pro). | ||||
| CVE-2026-7494 July 14, 2026 | Medium 5.0 CVSS 3.1 5.0, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2026-7494NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.94.0. Sonatype: Sonatype Nexus Repository 3 CE/Pro versions 3.0.0 up to and including 3.93.x. | ||||
| CVE-2020-11415 April 27, 2020 | Medium 4.9 CVSS 3.1 4.9, rated by NVD | no | no Sonatype CNA range | NVD's published range does not include this version. |
Ranges and sources for CVE-2020-11415NVD configuration (NVD status: Modified): from 2.0 (including), before 2.14.17; from 3.0 (including), before 3.22.1. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2020-24622 August 25, 2020 | Medium 4.9 CVSS 3.1 4.9, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2020-24622NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.27.0. Sonatype: Nexus Repository 3 versions up to and including 3.26.1. | ||||
| CVE-2021-29158 April 23, 2021 | Medium 4.9 CVSS 3.1 4.9, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2021-29158NVD configuration (NVD status: Analyzed): through 3.30.0. Sonatype: Nexus Repository Manager 3 Pro versions up to and including 3.30.0. | ||||
| CVE-2026-10741 June 17, 2026 | Medium 4.9 CVSS 3.1 4.9, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2026-10741NVD configuration (NVD status: Analyzed): from 3.1.0 (including), before 3.93.0. Sonatype: All Sonatype Nexus Repository 3.x versions from 3.1.0 through 3.92.x. | ||||
| CVE-2026-17594 August 7, 2026 | Medium 4.9 CVSS 3.1 4.9, rated by NVD | no | no | 3.95.0 already fixed in this version |
Ranges and sources for CVE-2026-17594NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.95.0. Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x. | ||||
| CVE-2026-17598 August 7, 2026 | Medium 4.9 CVSS 3.1 4.9, rated by NVD | no | no | 3.95.0 already fixed in this version |
Ranges and sources for CVE-2026-17598NVD configuration (NVD status: Analyzed): from 3.91.0 (including), before 3.95.0. Sonatype: Sonatype Nexus Repository 3 CE/Pro versions 3.91.0 through 3.94.x. | ||||
| CVE-2018-12100 June 11, 2018 | Medium 4.8 CVSS 3.0 4.8, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2018-12100NVD configuration (NVD status: Modified): from 3.3.0 (including), before 3.12.0. Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.11.0-01.. | ||||
| CVE-2020-10203 April 1, 2020 | Medium 4.8 CVSS 3.1 4.8, rated by NVD | no | no Sonatype CNA range | NVD's published range does not include this version. |
Ranges and sources for CVE-2020-10203NVD configuration (NVD status: Modified): before 3.21.2. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2021-34553 June 18, 2021 | Medium 4.3 CVSS 3.1 4.3, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2021-34553NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.31.0. Sonatype: Nexus Repository 3 versions up to and including 3.30.1. | ||||
| CVE-2021-42568 November 2, 2021 | Medium 4.3 CVSS 3.1 4.3, rated by NVD | no | no Sonatype CNA range | NVD's published range does not include this version. |
Ranges and sources for CVE-2021-42568NVD configuration (NVD status: Modified): from 3.0.0 (including), through 3.35.0. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2021-43293 November 4, 2021 | Medium 4.3 CVSS 3.1 4.3, rated by NVD | no | no Sonatype CNA range | NVD's published range does not include this version. |
Ranges and sources for CVE-2021-43293NVD configuration (NVD status: Modified): from 3.0.0 (including), through 3.35.0. Sonatype publishes no affected range in the CVE record (assigned by MITRE). | ||||
| CVE-2021-43961 March 17, 2022 | Medium 4.3 CVSS 3.1 4.3, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2021-43961NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.38.0. Sonatype: Nexus Repository 3 versions up to and including 3.37.3. | ||||
| CVE-2022-27907 March 30, 2022 | Medium 4.3 CVSS 3.1 4.3, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2022-27907NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.38.0. Sonatype: Nexus Repository 3 versions up to and including 3.37.3. | ||||
| CVE-2026-3048 May 11, 2026 | Low 3.8 CVSS 3.1 3.8, rated by NVD | no | no | Outside the affected range. |
Ranges and sources for CVE-2026-3048NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.92.0. Sonatype: Sonatype Nexus Repository 3.0.0 through 3.91.x (CE/Pro). | ||||
| CVE-2026-17595 August 7, 2026 | Low 2.7 CVSS 3.1 2.7, rated by NVD | no | no | 3.95.0 already fixed in this version |
Ranges and sources for CVE-2026-17595NVD configuration (NVD status: Analyzed): from 3.15.0 (including), before 3.95.0. Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions from 3.15.0 up to and including 3.94.x. | ||||
| CVE-2026-17597 August 7, 2026 | Low 2.7 CVSS 3.1 2.7, rated by NVD | no | no | 3.95.0 already fixed in this version |
Ranges and sources for CVE-2026-17597NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.95.0. Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions up to and including 3.94.x. | ||||
Sources and method
NVD's count evaluates NVD's published version ranges against this version; those ranges do not carry Sonatype's per-branch fixes, so the NVD column can read the same on either side of a fix that Sonatype names. Where NVD has not analyzed a record, the row reads "no NVD data", not "no".
3.95.4 carries the same 9 known CVEs as 4 other Sonatype Nexus Repository releases: 3.95.0, 3.95.1, 3.95.2, 3.95.3.
Sonatype's policy: Sonatype Nexus Repository releases are considered generally available and fully supported for a term of 1 year after the version's release date. Sonatype provides extended maintenance for each Sonatype Nexus Repository version for an additional 6 months before that version is considered sunset.
Sources: NVD (exact CPE match and the published configurations), the CVE Program record (the vendor's CNA entry with its affected and fixed versions), Sonatype's security advisories, release notes and end-of-life page. Pulled October 23, 2026. Every CVE row links to its NVD record and to the vendor's advisory.