Sonatype Nexus Repository Manager (Self-Hosted) 3.38.1
Approved changes feed: RSS · Atom
cpe:2.3:a:sonatype:nexus_repository_manager:3.38.1:*:*:*:*:*:*:*
part: a version: 3.38.1 update: *
| Vendor | Sonatype (4f13373e-a28c-5625-a507-2b5658f30fd0) |
|---|---|
| Product | Nexus Repository Manager (b0d475df-7c29-5589-9f88-bb4315bcf5a7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/sonatype/nexus |
purl2cpe | 2026-07-28 16:41:13.842929 |
pkg:github/sonatype/docker-nexus |
purl2cpe | 2026-07-28 16:41:13.842930 |
pkg:github/sonatype/nexus-public |
purl2cpe | 2026-07-28 16:41:13.842932 |
pkg:sonatype/repomanager2 |
purl2cpe | 2026-07-28 16:41:13.842933 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-7494 |
vulnerable | 2026-07-29 01:09:04.810891 |
Nexus Repository - SSRF in SSL Certificate Retrieval
Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects Nexus Repository 3.0.0 through versions prior to 3.94.0.
Published: 2026-07-14T15:46:24.649Z
Updated: 2026-07-14T17:12:29.505Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3329 |
vulnerable | 2026-07-29 00:46:20.311361 |
Nexus Repository Manager - Improper Restriction of Excessive Authentication Attempts
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.
Published: 2026-06-11T17:00:12.225Z
Updated: 2026-06-11T18:52:18.659Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14646 |
vulnerable | 2026-07-29 00:26:17.363717 |
Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect
Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymous user, if anonymous access is enabled — could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.
Published: 2026-07-14T16:49:46.416Z
Updated: 2026-07-15T15:13:01.396Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14645 |
vulnerable | 2026-07-29 00:26:17.258422 |
Nexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global Capability
Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations (Server-Side Request Forgery). This permission is granted by role assignment, independent of authentication status, so an unauthenticated user could also trigger this behavior if the anonymous role has been granted the permission.
Published: 2026-07-14T16:33:47.721Z
Updated: 2026-07-15T15:13:09.292Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11403 |
vulnerable | 2026-07-29 00:23:31.094298 |
Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation
A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable.
Published: 2026-07-14T15:28:23.509Z
Updated: 2026-07-14T15:59:18.173Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-10748 |
vulnerable | 2026-07-29 00:23:30.517155 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-10741 |
vulnerable | 2026-07-29 00:23:30.362070 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-7308 |
vulnerable | 2026-06-08 08:08:56.899354 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-5189 |
vulnerable | 2026-06-08 08:07:03.184320 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3438 |
vulnerable | 2026-06-08 08:01:18.618982 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3199 |
vulnerable | 2026-06-08 08:01:18.086334 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3048 |
vulnerable | 2026-06-08 08:01:17.522263 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-0600 |
vulnerable | 2026-06-08 07:47:12.657747 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5764 |
vulnerable | 2026-06-08 06:56:17.361105 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-4956 |
vulnerable | 2026-06-08 06:50:19.160319 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.