# Sonatype Nexus Repository 3 vulnerabilities Source: https://junglewise.ai/threats/technologies/nexus-repository-3 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/nexus-repository-3.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 16 vulnerabilities in Sonatype Nexus Repository 3: 0 in the last 7 days and 11 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-113374, was published on 4 November 2026. 8 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 8 - Last 90 days: 11 - All time: 16 (0 critical, 0 exploited in the wild) ## About Sonatype Nexus Repository 3 Nexus Repository 3 is a software platform for managing software components, build artifacts, and containers. ## Latest Sonatype Nexus Repository 3 vulnerabilities - [CVE-2026-113374: Sonatype Nexus Repository 3 authorization bypass in Rut Auth capability](https://junglewise.ai/threats/cve-2026-113374-sonatype-nexus-repository-3-does-not-require-realm) (info, published 4 Nov 2026) - [CVE-2026-113372: Sonatype Nexus Repository 3 YUM private key disclosure to read-only accounts](https://junglewise.ai/threats/cve-2026-113372-sonatype-nexus-repository-3-returns-the-private-signing-key-of-a) (info, published 4 Nov 2026) - [CVE-2026-113371: Sonatype Nexus Repository 3 signing passphrase disclosure in REST endpoint](https://junglewise.ai/threats/cve-2026-113371-sonatype-nexus-repository-3-returns-the-signing-passphrase-of-an) (info, published 4 Nov 2026) - [CVE-2026-113370: Sonatype Nexus Repository 3 SQL injection in Reindex Search Tables task](https://junglewise.ai/threats/cve-2026-113370-sonatype-nexus-repository-3-contains-a-sql-injection) (info, published 4 Nov 2026) - [CVE-2026-113369: Sonatype Nexus Repository stored XSS in OCI manifest artifact type](https://junglewise.ai/threats/cve-2026-113369-sonatype-nexus-repository-3-allows-a-user-account-that-can-push) (info, published 4 Nov 2026) - [CVE-2026-113368: Sonatype Nexus Repository 3 privilege escalation via unauthorized repository access](https://junglewise.ai/threats/cve-2026-113368-sonatype-nexus-repository-3-does-not-check-that-a-user-account) (info, published 4 Nov 2026) - [CVE-2026-97667: Sonatype Nexus Repository 3 stored cross-site scripting in R repository metadata](https://junglewise.ai/threats/cve-2026-97667-sonatype-nexus-repository-3-allows-a-user-account-that-holds-the) (info, published 15 Oct 2026) - [CVE-2026-97666: Sonatype Nexus Repository 3 information disclosure via ExtDirect](https://junglewise.ai/threats/cve-2026-97666-sonatype-nexus-repository-3-allows-an-unauthenticated-remote) (info, published 15 Oct 2026) - [CVE-2026-77125: Sonatype Nexus Repository authorization bypass in blobstore management](https://junglewise.ai/threats/cve-2026-77125-sonatype-nexus-repository-authorization-bypass-in-blobstore) (high, CVSS 7.1, published 2 Sep 2026) - [CVE-2026-77123: Sonatype Nexus Repository 3 sensitive information disclosure in capability API](https://junglewise.ai/threats/cve-2026-77123-sonatype-nexus-repository-3-sensitive-information-disclosure-in) (medium, CVSS 6.5, published 2 Sep 2026) - [CVE-2026-77122: Sonatype Nexus Repository authorization bypass in REST API](https://junglewise.ai/threats/cve-2026-77122-sonatype-nexus-repository-authorization-bypass-in-rest-api) (medium, CVSS 4.3, published 2 Sep 2026) - [CVE-2026-14646: Sonatype Nexus Repository 3 SSRF via proxy repository redirects](https://junglewise.ai/threats/cve-2026-14646-sonatype-nexus-repository-3-ssrf-via-proxy-repository-redirects) (info, CVSS 4.9, published 14 Jul 2026) - [CVE-2026-14645: Sonatype Nexus Repository 3 SSRF in Webhook Global capability](https://junglewise.ai/threats/cve-2026-14645-sonatype-nexus-repository-3-ssrf-in-webhook-global-capability) (info, CVSS 5.1, published 14 Jul 2026) - [CVE-2026-7494: Sonatype Nexus Repository 3 SSRF in SSL Certificate Retrieval endpoint](https://junglewise.ai/threats/cve-2026-7494-sonatype-nexus-repository-3-ssrf-in-ssl-certificate-retrieval) (info, CVSS 5.3, published 14 Jul 2026) - [CVE-2026-14504: Sonatype Nexus Repository 3 authorization bypass in component upload API](https://junglewise.ai/threats/cve-2026-14504-sonatype-nexus-repository-3-authorization-bypass-in-component) (info, CVSS 8.2, published 14 Jul 2026) - [CVE-2026-10748: Sonatype Nexus Repository OS command execution via license upload](https://junglewise.ai/threats/cve-2026-10748-sonatype-nexus-repository-os-command-execution-via-license-upload) (info, CVSS 8.6, published 16 Jun 2026) ## Most severe Sonatype Nexus Repository 3 vulnerabilities - [CVE-2026-77125: Sonatype Nexus Repository authorization bypass in blobstore management](https://junglewise.ai/threats/cve-2026-77125-sonatype-nexus-repository-authorization-bypass-in-blobstore) (high, CVSS 7.1, published 2 Sep 2026) - [CVE-2026-77123: Sonatype Nexus Repository 3 sensitive information disclosure in capability API](https://junglewise.ai/threats/cve-2026-77123-sonatype-nexus-repository-3-sensitive-information-disclosure-in) (medium, CVSS 6.5, published 2 Sep 2026) - [CVE-2026-77122: Sonatype Nexus Repository authorization bypass in REST API](https://junglewise.ai/threats/cve-2026-77122-sonatype-nexus-repository-authorization-bypass-in-rest-api) (medium, CVSS 4.3, published 2 Sep 2026) - [CVE-2026-10748: Sonatype Nexus Repository OS command execution via license upload](https://junglewise.ai/threats/cve-2026-10748-sonatype-nexus-repository-os-command-execution-via-license-upload) (info, CVSS 8.6, published 16 Jun 2026) - [CVE-2026-14504: Sonatype Nexus Repository 3 authorization bypass in component upload API](https://junglewise.ai/threats/cve-2026-14504-sonatype-nexus-repository-3-authorization-bypass-in-component) (info, CVSS 8.2, published 14 Jul 2026) - [CVE-2026-7494: Sonatype Nexus Repository 3 SSRF in SSL Certificate Retrieval endpoint](https://junglewise.ai/threats/cve-2026-7494-sonatype-nexus-repository-3-ssrf-in-ssl-certificate-retrieval) (info, CVSS 5.3, published 14 Jul 2026) - [CVE-2026-14645: Sonatype Nexus Repository 3 SSRF in Webhook Global capability](https://junglewise.ai/threats/cve-2026-14645-sonatype-nexus-repository-3-ssrf-in-webhook-global-capability) (info, CVSS 5.1, published 14 Jul 2026) - [CVE-2026-14646: Sonatype Nexus Repository 3 SSRF via proxy repository redirects](https://junglewise.ai/threats/cve-2026-14646-sonatype-nexus-repository-3-ssrf-via-proxy-repository-redirects) (info, CVSS 4.9, published 14 Jul 2026) - [CVE-2026-97666: Sonatype Nexus Repository 3 information disclosure via ExtDirect](https://junglewise.ai/threats/cve-2026-97666-sonatype-nexus-repository-3-allows-an-unauthenticated-remote) (info, published 15 Oct 2026) - [CVE-2026-97667: Sonatype Nexus Repository 3 stored cross-site scripting in R repository metadata](https://junglewise.ai/threats/cve-2026-97667-sonatype-nexus-repository-3-allows-a-user-account-that-holds-the) (info, published 15 Oct 2026) ## Vulnerabilities per week 8 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 3 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 6 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Sonatype technologies - [Sonatype Nexus Repository Manager](https://junglewise.ai/threats/technologies/nexus-repository-manager): 15 vulnerabilities - [Sonatype Nexus Repository](https://junglewise.ai/threats/technologies/nexus-repository): 8 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Sonatype Nexus Repository 3 vulnerabilities", https://junglewise.ai/threats/technologies/nexus-repository-3, 12 November 2026.