Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Sonatype Nexus Repository 3 3.94.0 Clear all filters
TI-2026-12343 CVE-2026-14646 · GHSA-jxph-5989-pgpj

Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect

Priority LOW 22

Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers.

CVSS 4.0MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00353 Published 2026-07-14 Fixed in 3.94.0 CWE-918
TI-2026-12342 CVE-2026-14645 · GHSA-7364-vc59-2428

Nexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global Capability

Priority LOW 23

Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause…

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00364 Published 2026-07-14 Fixed in 3.94.0 CWE-918
TI-2026-12251 CVE-2026-14504 · GHSA-3v8f-7593-ph9g

Nexus Repository 3 - Authorization Bypass in Component Upload API

Priority LOW 36

An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00373 Published 2026-07-14 Fixed in 3.94.0 CWE-862