Skip to content
Noroxi

Sonatype records

72 published records for vendor sonatype.

Researcher profile

Entered KEV
2 · 2.8%
Weaponized
2 · 2.8%
Pre-auth RCE
5
With a fix record
50%
Median publish → KEV
788 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 24
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

72 records
  • CVE-2020-10199
    95Now

    Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    sonatype · nexusApr 1, 2020

  • CVE-2019-7238
    92Now

    Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.

    CriticalCVSS 9.8KEVWeaponizedEPSS 76%

    sonatype · nexus repository managerMar 21, 2019

  • CVE-2019-5475
    41Plan

    The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vuln

    HighCVSS 8.8Proof of conceptEPSS 18%

    sonatype · nexus repository managerSep 3, 2019

  • CVE-2020-10204
    40Plan

    Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.

    HighCVSS 7.2Proof of conceptEPSS 38%

    sonatype · nexusApr 1, 2020

  • CVE-2019-9629
    39Monitor

    Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).

    CriticalCVSS 9.8No exploitEPSS 1%

    sonatype · nexus repository managerJul 8, 2019

  • CVE-2017-17717
    39Monitor

    Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature

    CriticalCVSS 9.8No exploitEPSS 0%

    sonatype · nexus repository managerDec 17, 2017

  • CVE-2020-11444
    38Monitor

    Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.

    HighCVSS 8.8Proof of conceptEPSS 8%

    sonatype · nexusApr 2, 2020

  • CVE-2026-3199
    37Monitor

    Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection

    CriticalCVSS 9.4No exploitEPSS 0%

    sonatype · nexus repository managerApr 8, 2026

  • CVE-2020-15871
    36Monitor

    Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.

    HighCVSS 8.8No exploitEPSS 2%

    sonatype · nexus repository managerJul 31, 2020

  • CVE-2020-11753
    36Monitor

    An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0.

    HighCVSS 8.8No exploitEPSS 1%

    sonatype · nexus repository managerApr 20, 2020

  • CVE-2026-5189
    36Monitor

    Nexus Repository 3 - Hardcoded Credential in Internal Database Component

    CriticalCVSS 9.2No exploitEPSS 0%

    sonatype · nexus repository managerApr 15, 2026

  • CVE-2020-15012
    35Monitor

    A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19.

    HighCVSS 8.6No exploitEPSS 2%

    sonatype · nexus repository managerOct 12, 2020

  • CVE-2026-17601
    35Monitor

    Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator

    HighCVSS 8.9No exploitEPSS 0%

    sonatype · nexus repository managerAug 7, 2026

  • CVE-2026-17603
    34Monitor

    Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API

    HighCVSS 8.7No exploitEPSS 0%

    sonatype · nexus repository managerAug 7, 2026

  • CVE-2026-14644
    34Monitor

    Nexus Repository 3 - Privilege Escalation

    HighCVSS 8.6No exploitEPSS 0%

    sonatype · nexus repository managerAug 7, 2026

  • CVE-2026-11403
    34Monitor

    Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation

    HighCVSS 8.7No exploitEPSS 0%

    sonatype · nexus repository managerJul 14, 2026

  • CVE-2026-3329
    34Monitor

    Nexus Repository Manager - Improper Restriction of Excessive Authentication Attempts

    HighCVSS 8.7No exploitEPSS 0%

    sonatype · nexus repository managerJun 11, 2026

  • CVE-2026-17600
    34Monitor

    Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation

    HighCVSS 8.7No exploitEPSS 0%

    sonatype · nexus repository managerAug 7, 2026

  • CVE-2026-10748
    34Monitor

    Nexus Repository 3 - Remote Code Execution via License Deserialization

    HighCVSS 8.6No exploitEPSS 0%

    sonatype · nexus repository managerJun 16, 2026

  • CVE-2021-40143
    33Monitor

    Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection.

    HighCVSS 8.2No exploitEPSS 2%

    sonatype · nexus repository managerSep 7, 2021

  • CVE-2026-17594
    32Monitor

    Nexus Repository 3 - Authorization Bypass in Repository Creation

    HighCVSS 8.2Proof of conceptEPSS 0%

    sonatype · nexus repository managerAug 7, 2026

  • CVE-2026-14504
    32Monitor

    Nexus Repository 3 - Authorization Bypass in Component Upload API

    HighCVSS 8.2No exploitEPSS 0%

    sonatype · nexus repository managerJul 14, 2026

  • CVE-2014-0792
    31Monitor

    Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vecto

    HighCVSS 7.5No exploitEPSS 3%

    sonatype · nexusJan 17, 2014

  • CVE-2014-2034
    31Monitor

    Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown v

    HighCVSS 7.5No exploitEPSS 2%

    sonatype · nexusMar 31, 2014

  • CVE-2014-9389
    31Monitor

    Directory traversal vulnerability in Sonatype Nexus OSS and Pro before 2.11.1-01 allows remote attackers to read or write to arbitrary files

    HighCVSS 7.5No exploitEPSS 1%

    sonatype · nexusJan 5, 2015