Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Sonatype Nexus Repository 3.91.0 Clear all filters
TI-2026-02763 CVE-2026-3199 · GHSA-w2wq-7mq5-mvww

Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection

Priority MEDIUM 49

A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.…

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00577 Published 2026-04-08 Fixed in 3.91.0 CWE-502
TI-2026-02966 CVE-2026-3438 · GHSA-mx59-6f7x-f5f2

Nexus Repository 3 - Reflected Cross-Site Scripting (XSS) in ?describe Pages

Priority LOW 23

A reflected cross-site scripting vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2 that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.004 Published 2026-04-08 Fixed in 3.91.0 CWE-79