Known Vulnerabilities for products from Sonatype
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Sonatype".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-113374 json | Not Provided | 2026-11-04 | 2026-11-04 | |
| CVE-2026-113373 json | Not Provided | 2026-11-04 | 2026-11-04 | |
| CVE-2026-113372 json | Not Provided | 2026-11-04 | 2026-11-04 | |
| CVE-2026-113371 json | Not Provided | 2026-11-04 | 2026-11-04 | |
| CVE-2026-113370 json | Not Provided | 2026-11-04 | 2026-11-04 | |
| CVE-2026-113369 json | Not Provided | 2026-11-04 | 2026-11-04 | |
| CVE-2026-113368 json | Not Provided | 2026-11-04 | 2026-11-04 | |
| CVE-2026-97712 json | Not Provided | 2026-10-15 | 2026-10-16 | |
| CVE-2026-97667 json | Not Provided | 2026-10-15 | 2026-10-15 | |
| CVE-2026-97666 json | Not Provided | 2026-10-15 | 2026-10-15 | |
| CVE-2026-77125 json | A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did ... | Not Provided | 2026-09-02 | 2026-09-22 |
| CVE-2026-77124 json | In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not v... | Not Provided | 2026-09-02 | 2026-09-22 |
| CVE-2026-77123 json | Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding t... | Not Provided | 2026-09-02 | 2026-09-22 |
| CVE-2026-77122 json | An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Son... | Not Provided | 2026-09-02 | 2026-09-22 |
| CVE-2026-77121 json | A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversiz... | Not Provided | 2026-09-02 | 2026-10-07 |
| CVE-2026-17603 json | Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore... | Not Provided | 2026-08-07 | 2026-10-23 |
| CVE-2026-17601 json | A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own r... | Not Provided | 2026-08-07 | 2026-10-23 |
| CVE-2026-17600 json | Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions wh... | Not Provided | 2026-08-07 | 2026-10-23 |
| CVE-2026-17599 json | Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This en... | Not Provided | 2026-08-07 | 2026-10-23 |
| CVE-2026-17598 json | Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creat... | Not Provided | 2026-08-07 | 2026-10-23 |
Known software with vulnerabilities from Sonatype
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Sonatype | Nexus | 2.0.4 |
| Application | Sonatype | Nexus Iq Server | 1.12 |
| Application | Sonatype | Nexus Repository Manager | 2.0 |
| Application | Sonatype | Nexus Repository Manager 2 | 2.0 |
| Application | Sonatype | Nexus Repository Manager 3 | 3.0.0 |