Nexus Repository Manager
Approved changes feed: RSS · Atom
cpe:2.3:a:sonatype:nexus_repository_manager:3.70.5:*:*:*:*:*:*:*part: a version: 3.70.5 update: *
| Vendor | Sonatype (4f13373e-a28c-5625-a507-2b5658f30fd0) |
|---|---|
| Product | Nexus Repository Manager (b0d475df-7c29-5589-9f88-bb4315bcf5a7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-97666 |
vulnerable | 2026-11-03 10:15:26.549372 |
Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.
Published: 2026-10-15T15:34:40.295Z
Updated: 2026-10-15T16:11:15.158Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14644 |
vulnerable | 2026-09-16 04:33:11.952970 |
Nexus Repository 3 - Privilege Escalation
Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint.
Published: 2026-08-07T16:07:43.907Z
Updated: 2026-08-08T03:55:42.061Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-7494 |
vulnerable | 2026-07-29 01:09:04.817169 |
Nexus Repository - SSRF in SSL Certificate Retrieval
Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects Nexus Repository 3.0.0 through versions prior to 3.94.0.
Published: 2026-07-14T15:46:24.649Z
Updated: 2026-07-14T17:12:29.505Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3329 |
vulnerable | 2026-07-29 00:46:20.314817 |
Nexus Repository Manager - Improper Restriction of Excessive Authentication Attempts
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.
Published: 2026-06-11T17:00:12.225Z
Updated: 2026-06-11T18:52:18.659Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14646 |
vulnerable | 2026-07-29 00:26:17.368244 |
Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect
Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymous user, if anonymous access is enabled — could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.
Published: 2026-07-14T16:49:46.416Z
Updated: 2026-07-15T15:13:01.396Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14645 |
vulnerable | 2026-07-29 00:26:17.315397 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11403 |
vulnerable | 2026-07-29 00:23:31.097010 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-10748 |
vulnerable | 2026-07-29 00:23:30.520415 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-10741 |
vulnerable | 2026-07-29 00:23:30.436579 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-7308 |
vulnerable | 2026-06-08 08:08:56.955022 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-5189 |
vulnerable | 2026-06-08 08:07:03.232100 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3048 |
vulnerable | 2026-06-08 08:01:17.577013 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.