7 matches found
CVE-2026-17596
Nexus Repository 3 was found to be vulnerable to stored cross-site scripting XSS. A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system...
EUVD-2026-54518
Nexus Repository 3 was found to be vulnerable to stored cross-site scripting XSS. A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system...
CVE-2026-17596: Improper Neutralization of Input During Web Page Generation
Nexus Repository 3 was found to be vulnerable to stored cross-site scripting XSS. A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system...
PT-2026-69058
Name of the Vulnerable Software and Affected Versions Nexus Repository 3 versions prior to 3.95.0 Description Stored cross-site scripting XSS occurs when a user with nexus:blobstores:create or nexus:blobstores:update permissions sets a blob store name containing malicious script content. This...
GO-2026-5822 regclient may leak authentication credentials to external blob stores in github.com/regclient/regclient
regclient may leak authentication credentials to external blob stores in github.com/regclient/regclient...
GHSA-QVQC-4C52-X6QP regclient may leak authentication credentials to external blob stores
Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Example attack A malicious registry serves an OCI image...
regclient may leak authentication credentials to external blob stores
Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Example attack A malicious registry serves an OCI image...