Sonatype
Sonatype Security Releases - October 2026
sonatype-2026-10 Oct 1, 2026 Source: Vendor
Sonatype security advisories for October 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-97665
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
4 lines
Showing 1–4 of 4
CVE-2026-97665
BR2026-0000-032630
Nexus Repository 3
unclaimed
A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packag...
Credited as wupco123
CVE-2026-97666
BR2026-0000-032631
Nexus Repository 3
unclaimed
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to lea...
Credited as wupco123
CVE-2026-97667
BR2026-0000-032632
Nexus Repository 3
unclaimed
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the br...
Credited as Uttam Sabhadiya
CVE-2026-97712
BR2026-0000-032633
Nexus Repository 3
unclaimed
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than ...
Credited as Beni Saprulah