EUVD-2026-117062

Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository a user account that holds the edit permission on that repository to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the...

CVE-2026-97667

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...

EUVD-2026-102154

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...

PT-2026-115007

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...

CVE-2026-97667: Improper Neutralization of Input During Web Page Generation

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...