PT-2026-69064

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 affected versions not specified Description Insufficient restrictions on HikariCP connection-pool properties within the DataStore configuration API allow a user with the nx-datastores-update permission to set the...

CVE-2026-17603: Improper Control of Generation of Code

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on...

PT-2026-69058

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 versions prior to 3.95.0 Description Stored cross-site scripting XSS occurs when a user with nexus:blobstores:create or nexus:blobstores:update permissions sets a blob store name containing malicious script content. This...

CVE-2026-17598: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property val...

CVE-2026-17593: Use of Externally-Controlled Input to Select Classes or Code

An account holding the nexus:settings:update permission in Nexus Repository 3 or the equivalent nexus:settings permission in the legacy Nexus Repository 2 could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of...

CVE-2026-17597: Server-Side Request Forgery (SSRF)

Nexus Repository 3 contains a Server-Side Request Forgery SSRF vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt...

CVE-2026-17596: Improper Neutralization of Input During Web Page Generation

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting XSS. A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system...

CVE-2026-17600: Insufficient Session Expiration

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue...

PT-2026-69062

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository 3 affected versions not specified Description Sonatype Nexus Repository 3 fails to immediately terminate active login sessions or revoke cached permissions when a user account is deleted, deactivated, or has its...

PT-2026-69059

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 versions prior to 3.95.0 Description A Server-Side Request Forgery SSRF issue exists in the email configuration verification feature. A user with the nexus:settings:update permission can submit arbitrary host and port values...

co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.0), org.codelibs.fesen.tool:fesen-plugin-cli (>=0.10.0, <=0.16.0) +112 more potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (>=1.0.4, <=2.1.13)

org.bouncycastle:bcpg-fips MAVEN version =1.0.4, =1.26.0, =0.10.0, =1.0.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.96.4-01 and more Source cves: CVE-2026-59648https://vulners.c...

EUVD-2026-43959

Nexus Repository 3 did not apply its existing Server-Side Request Forgery SSRF protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymo...

EUVD-2026-43744

Nexus Repository 3 is vulnerable to Server-Side Request Forgery SSRF via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects...

EUVD-2026-43737

Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations Server-Side Request...

EUVD-2026-43750

An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended write-permission check...

EUVD-2026-43724

A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm NuGet API Key, Docker Bearer Token, or npm Bearer Token must be enabled an...

CVE-2026-14645

Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations Server-Side Request...

CVE-2026-14646 Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect

Nexus Repository 3 did not apply its existing Server-Side Request Forgery SSRF protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymo...

CVE-2026-14646 Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect

Nexus Repository 3 did not apply its existing Server-Side Request Forgery SSRF protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymo...

CVE-2026-14645 Nexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global Capability

Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations Server-Side Request...