# Security Advisories

## CVE-2026

- [CVE-2026-14646 Nexus Repository 3 - SSRF via HTTP Redirect - 2026-07-14](https://support.sonatype.com/hc/en-us/articles/53165019641363-CVE-2026-14646-Nexus-Repository-3-SSRF-via-HTTP-Redirect-2026-07-14)
- [CVE-2026-14645 Nexus Repository 3 - Webhook SSRF - 2026-07-14](https://support.sonatype.com/hc/en-us/articles/53158843564179-CVE-2026-14645-Nexus-Repository-3-Webhook-SSRF-2026-07-14)
- [CVE-2026-14504 Nexus Repository 3 - Authorization Bypass in Component Upload API - 2026-07-14](https://support.sonatype.com/hc/en-us/articles/53137654741907-CVE-2026-14504-Nexus-Repository-3-Authorization-Bypass-in-Component-Upload-API-2026-07-14)
- [CVE-2026-7494 Nexus Repository 3 - SSRF in SSL Certificate Retrieval - 2026-07-14](https://support.sonatype.com/hc/en-us/articles/53126069518227-CVE-2026-7494-Nexus-Repository-3-SSRF-in-SSL-Certificate-Retrieval-2026-07-14)
- [CVE-2026-3329 Nexus Repository 3 - Authentication Handling Issue - 2026-06-11](https://support.sonatype.com/hc/en-us/articles/52482870409491-CVE-2026-3329-Nexus-Repository-3-Authentication-Handling-Issue-2026-06-11)
- [CVE-2026-11403 Nexus Repository 3 - Insufficient Entropy in API Key Generation - 2026-07-14](https://support.sonatype.com/hc/en-us/articles/52347011450515-CVE-2026-11403-Nexus-Repository-3-Insufficient-Entropy-in-API-Key-Generation-2026-07-14)
- [CVE-2026-10741 Nexus Repository 3 - Incorrect Authorization - 2026-06-17](https://support.sonatype.com/hc/en-us/articles/52341191736851-CVE-2026-10741-Nexus-Repository-3-Incorrect-Authorization-2026-06-17)
- [CVE-2026-10748 Nexus Repository 3 - Remote Code Execution - 2026-06-16](https://support.sonatype.com/hc/en-us/articles/52335766035603-CVE-2026-10748-Nexus-Repository-3-Remote-Code-Execution-2026-06-16)
- [CVE-2026-7308 Nexus Repository 3 - Stored Cross-Site Scripting (XSS) - 2026-05-11](https://support.sonatype.com/hc/en-us/articles/51592065985939-CVE-2026-7308-Nexus-Repository-3-Stored-Cross-Site-Scripting-XSS-2026-05-11)
- [CVE-2026-3048 Nexus Repository 3 - Improper LDAP Referral Handling - 2026-05-11](https://support.sonatype.com/hc/en-us/articles/51591695462675-CVE-2026-3048-Nexus-Repository-3-Improper-LDAP-Referral-Handling-2026-05-11)
- [CVE-2026-5189 Nexus Repository 3 - Hardcoded Credential in Internal Database Component - 2026-04-15](https://support.sonatype.com/hc/en-us/articles/50817138825491-CVE-2026-5189-Nexus-Repository-3-Hardcoded-Credential-in-Internal-Database-Component-2026-04-15)
- [CVE-2026-3199 Nexus Repository 3 - Authenticated Remote Code Execution - 2026-04-08](https://support.sonatype.com/hc/en-us/articles/50615414548499-CVE-2026-3199-Nexus-Repository-3-Authenticated-Remote-Code-Execution-2026-04-08)
- [CVE-2026-3438 Nexus Repository 3 - Reflected Cross-Site Scripting (XSS) - 2026-04-08](https://support.sonatype.com/hc/en-us/articles/50609137161363-CVE-2026-3438-Nexus-Repository-3-Reflected-Cross-Site-Scripting-XSS-2026-04-08)
- [CVE-2026-0601 Nexus Repository 3 - Cross-Site Scripting - 2026-01-13](https://support.sonatype.com/hc/en-us/articles/47934334375955-CVE-2026-0601-Nexus-Repository-3-Cross-Site-Scripting-2026-01-13)
- [CVE-2026-0600 Nexus Repository 3 - Server-Side Request Forgery - 2026-01-13](https://support.sonatype.com/hc/en-us/articles/47928855816595-CVE-2026-0600-Nexus-Repository-3-Server-Side-Request-Forgery-2026-01-13)
- [CVE-2025-13488 Nexus Repository 3 - Stored Cross-Site Scripting (XSS) - 2025-12-04](https://support.sonatype.com/hc/en-us/articles/46896142768019-CVE-2025-13488-Nexus-Repository-3-Stored-Cross-Site-Scripting-XSS-2025-12-04)
- [CVE-2025-9868 Nexus Repository 2 – SSRF Vulnerability in Remote Browser Plugin](https://support.sonatype.com/hc/en-us/articles/45363201583635-CVE-2025-9868-Nexus-Repository-2-SSRF-Vulnerability-in-Remote-Browser-Plugin)

## CVE-2024

- [CVE-2024-5764 - Nexus Repository Manager 3 - Static hard-coded encryption passphrase used by default - 2024-10-17](https://support.sonatype.com/hc/en-us/articles/34496708991507-CVE-2024-5764-Nexus-Repository-Manager-3-Static-hard-coded-encryption-passphrase-used-by-default-2024-10-17)
- [CVE-2024-5082 Nexus Repository 2 - Remote Code Execution](https://support.sonatype.com/hc/en-us/articles/30694125380755-CVE-2024-5082-Nexus-Repository-2-Remote-Code-Execution)
- [CVE-2024-5083 Nexus Repository 2 - Stored XSS Vulnerability](https://support.sonatype.com/hc/en-us/articles/30693989411987-CVE-2024-5083-Nexus-Repository-2-Stored-XSS-Vulnerability)
- [CVE-2024-4956 Nexus Repository 3 - Path Traversal - 2024-05-16](https://support.sonatype.com/hc/en-us/articles/29416509323923-CVE-2024-4956-Nexus-Repository-3-Path-Traversal-2024-05-16)
- [Mitigations for CVE-2024-4956 Nexus Repository 3 Vulnerability](https://support.sonatype.com/hc/en-us/articles/29412417068819-Mitigations-for-CVE-2024-4956-Nexus-Repository-3-Vulnerability)
- [CVE-2024-1142 Sonatype IQ Server Path Traversal- 2024-03-06](https://support.sonatype.com/hc/en-us/articles/27034479038739-CVE-2024-1142-Sonatype-IQ-Server-Path-Traversal-2024-03-06)

## CVE-2022

- [CVE-2022-27907 Nexus Repository 3 - Server Side Request Forgery (SSRF) - 2022-03-30](https://support.sonatype.com/hc/en-us/articles/5011047953555-CVE-2022-27907-Nexus-Repository-3-Server-Side-Request-Forgery-SSRF-2022-03-30)

## CVE-2021

- [CVE-2021-43961 Nexus Repository 3 - HTML Injection - 2022-03-02](https://support.sonatype.com/hc/en-us/articles/4412183372307-CVE-2021-43961-Nexus-Repository-3-HTML-Injection-2022-03-02)
- [CVE-2021-40143 Nexus Repository 3 - HTTP Header Injection - 2021-09-01](https://support.sonatype.com/hc/en-us/articles/4405941762579-CVE-2021-40143-Nexus-Repository-3-HTTP-Header-Injection-2021-09-01)
- [CVE-2021-37152 Nexus Repository 3 - Multiple Cross Site Scripting XSS - 2021-08-05](https://support.sonatype.com/hc/en-us/articles/4404115639827-CVE-2021-37152-Nexus-Repository-3-Multiple-Cross-Site-Scripting-XSS-2021-08-05)
- [CVE-2021-34553 Nexus Repository 3 - Directory Traversal - 2021-06-17](https://support.sonatype.com/hc/en-us/articles/4402433828371-CVE-2021-34553-Nexus-Repository-3-Directory-Traversal-2021-06-17)
- [CVE-2021-30635 Nexus Repository Manager 3 - Directory Traversal - 2021-04-22](https://support.sonatype.com/hc/en-us/articles/1500006879561-CVE-2021-30635-Nexus-Repository-Manager-3-Directory-Traversal-2021-04-22)
- [CVE-2021-29158 Nexus Repository Manager 3 - Sensitive Information Disclosure - 2021-04-22](https://support.sonatype.com/hc/en-us/articles/1500006126462-CVE-2021-29158-Nexus-Repository-Manager-3-Sensitive-Information-Disclosure-2021-04-22)