CVEs published by Sonatype

CVEs published by Sonatype (CVE Numbering Authority). 5 tracked.

CVE-2026-17603 HIGH 8.8 UPGRADE Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set throug
CVE-2026-17600 HIGH 8.8 UPGRADE Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached
CVE-2026-17599 HIGH 7.2 UPGRADE Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onbo
CVE-2026-17601 HIGH 7.2 UPGRADE A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned
CVE-2026-17598 MEDIUM 4.9 UPGRADE Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task proper