Skip to content
Sign in

Vendor

Sonatype

Alert
No CISA KEV deadline is open. CISA last added a Sonatype CVE on 10 Dec 2021.

Tracked since 6 Nov · latest article 6 Nov · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 2 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

1Articles · 7 days

usual rate

Exploited, by due date2

Sonatype CVEs in CISA KEV with their federal deadlines. None is open.

Exploited Sonatype CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2019-7238Nexus Repository Manager10 DecPassed 10 Jun–
In CISA KEVCVE-2020-10199Nexus Repository3 NovPassed 3 May–
CSV of 2 entries for Sonatype

Patch cadence and exploit odds

How often CISA adds Sonatype CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’250Q3 ’250Q4 ’250Q1 ’260Q2 ’260Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20260
Q3 20260
Q4 20260

No additions in the last eight quarters.

Fix listed

6 of 6 CVEs in coverage

Every CVE in coverage has a fix recorded.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-113374: 20.5th percentileCVE-2026-113373: 16.3th percentileCVE-2026-113369: 15.6th percentileCVE-2026-113371: 12th percentileCVE-2026-113372: 12th percentileCVE-2026-113370: 11.4th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-11337420.5
CVE-2026-11337316.3
CVE-2026-11336915.6
CVE-2026-11337112
CVE-2026-11337212
CVE-2026-11337011.4

Coverage1 article · all time

The latest article naming Sonatype, in the shared story grammar.

Full timeline
Developinglatest 10 hours ago1 article1 outlet

1 article from 1 outlet since 6 Nov. Still developing; the latest report was 10 hours ago.

Now6 NovFirst reportSecurityOnline · 6 Nov, 01:30
  • Fri 6 Nov, 01:30 UTC. SecurityOnline, first report. Sonatype fixes seven Nexus Repository flaws enabling SSO bypass and privilege escalation.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
Show all 1 articles as a list
  1. Fri 6 NovDay 01
    1. Sonatype fixes seven Nexus Repository flaws enabling SSO bypass and privilege escalation01:30 · SecurityOnline · First report

All CVEs in coverage6

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-113374

    Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation

    8.6High0.3% EPSS · 1 article
  • CVE-2026-113373

    Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again

    9.1Critical0.3% EPSS · 1 article
  • CVE-2026-113369

    Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab

    6.3Medium0.2% EPSS · 1 article
  • CVE-2026-113371

    Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase

    7.1High0.2% EPSS · 1 article
  • CVE-2026-113372

    Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Key

    7.1High0.2% EPSS · 1 article
  • CVE-2026-113370

    Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task

    7.7High0.2% EPSS · 1 article
CyberSIXTSignal over noise
Updated AboutDevelopersSign in