Nexus Repository Manager

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:sonatype:nexus_repository_manager:3.88.1:*:*:*:*:*:*:*

part: a version: 3.88.1 update: *

VendorSonatype (4f13373e-a28c-5625-a507-2b5658f30fd0)
ProductNexus Repository Manager (b0d475df-7c29-5589-9f88-bb4315bcf5a7)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-7494 vulnerable 2026-07-29 01:09:04.861598 Nexus Repository - SSRF in SSL Certificate Retrieval
Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects Nexus Repository 3.0.0 through versions prior to 3.94.0.
Published: 2026-07-14T15:46:24.649Z
Updated: 2026-07-14T17:12:29.505Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-11403 vulnerable 2026-07-29 00:23:31.146884 Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation
A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable.
Published: 2026-07-14T15:28:23.509Z
Updated: 2026-07-14T15:59:18.173Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.