Sonatype Nexus Repository Manager

Name: Sonatype Nexus Repository Manager
Brand: Sonatype

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

1critical9high9medium3low

updated 2026-10-27

vulnerabilities (32)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-5082US	—	2.81% (86th)	Exploit	no fix	2024-11-14	≤ Pro <2.15.2
CVE-2024-5083US	—	0.41% (35th)	Exploit	no fix	2024-11-14	≤ Pro <2.15.2
CVE-2024-5764US	medium6.5OT elevated	0.39% (33rd)	Exploit	3	2024-10-23	2 versions
CVE-2026-17594US	medium4.9OT elevated	0.99% (62nd)	—	3.95.0	2026-08-07	< 3.95.0
CVE-2026-17603US	high8.8	0.87% (59th)	—	3.95.0	2026-08-07	< 3.95.0
CVE-2026-17593US	high7.2	0.77% (55th)	—	3.95.0	2026-08-07	< 3.95.0
CVE-2026-97666US	—	0.62% (49th)	—	3.97.0	2026-10-15	< 3.97.0
CVE-2026-14644US	high7.2	0.61% (49th)	—	3.95.0	2026-08-07	< 3.95.0
CVE-2026-5189US	critical9.8OT elevated	0.53% (44th)	—	3.71.0	2026-04-15	< 3.71.0
CVE-2026-11403US	high7.5	0.53% (44th)	—	3.94.0	2026-07-14	2 versions
CVE-2026-17601US	high7.2OT elevated	0.52% (44th)	—	3.95.0	2026-08-07	< 3.95.0
CVE-2025-9868US	—	0.50% (42nd)	—	3	2025-10-08	< 3
CVE-2026-17599US	high7.2	0.49% (42nd)	—	3.95.0	2026-08-07	< 3.95.0
CVE-2026-3329US	high7.5	0.45% (39th)	—	3.93.0	2026-06-11	2 versions
CVE-2026-17600US	high8.8	0.44% (38th)	—	3.95.0	2026-08-07	< 3.95.0
CVE-2026-17596US	medium6.1	0.43% (37th)	—	3.95.0	2026-08-07	< 3.95.0
CVE-2026-0601US	—	0.43% (37th)	—	3.88.0	2026-01-14	< 3.88.0
CVE-2026-17598US	medium4.9	0.39% (33rd)	—	3.95.0	2026-08-07	< 3.95.0
CVE-2026-17595US	low2.7	0.39% (33rd)	—	3.95.0	2026-08-07	< 3.95.0
CVE-2026-3438US	medium6.1	0.39% (32nd)	—	3.91.0	2026-04-08	< 3.91.0
CVE-2026-14504US	medium6.5OT elevated	0.37% (31st)	—	3.94.0	2026-07-14	< 3.94.0
CVE-2026-14645US	medium5.5	0.36% (30th)	—	3.94.0	2026-07-14	< 3.94.0
CVE-2026-14646US	high7.7	0.35% (29th)	—	3.94.0	2026-07-14	< 3.94.0
CVE-2025-13488US	—	0.33% (26th)	—	3	2025-12-04	3 versions
CVE-2026-97665US	—OT elevated	0.33% (25th)	—	3.97.0	2026-10-15	< 3.97.0
CVE-2026-0600US	—	0.31% (24th)	—	3.88.0	2026-01-14	< 3.88.0
CVE-2026-17597US	low2.7	0.31% (24th)	—	3.95.0	2026-08-07	< 3.95.0
CVE-2026-97667US	—	0.30% (22nd)	—	3.97.0	2026-10-15	< 3.97.0
CVE-2026-10741US	medium4.9OT elevated	0.27% (19th)	—	3.93.0	2026-06-17	2 versions
CVE-2026-97712US	—OT elevated	0.27% (18th)	—	3.97.0	2026-10-15	< 3.97.0
CVE-2026-7494US	medium5.0	0.19% (8th)	—	3.94.0	2026-07-14	< 3.94.0
CVE-2026-3048US	low3.8	0.17% (6th)	—	3.92.0	2026-05-11	< 3.92.0

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-918Server-Side Request Forgery (SSRF)7 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6 CVEs
CWE-862Missing Authorization4 CVEs
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')2 CVEs
CWE-798Use of Hard-coded Credentials2 CVEs
CWE-863Incorrect Authorization2 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')2 CVEs
CWE-307Improper Restriction of Excessive Authentication Attempts1 CVEs

sources (2)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)32 CVEs
EUEU Vulnerability Database (ENISA)3 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan