https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-113374/https://vulnfeed.org/cve/CVE-2026-113374/Wed, 04 Nov 2026 20:18:57 +0000Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission (nexus:capabilities:create) can create this capability, which turns on header-based authentication for the instance. A remote client can then authenticate as an existing user, including an administrator, without credentials.https://vulnfeed.org/cve/CVE-2026-113370/https://vulnfeed.org/cve/CVE-2026-113370/Wed, 04 Nov 2026 20:18:56 +0000Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus database. The task is available only when the non-default setting nexus.reindex.search.by.pattern.visible is set to true.https://vulnfeed.org/cve/CVE-2026-113371/https://vulnfeed.org/cve/CVE-2026-113371/Wed, 04 Nov 2026 20:18:56 +0000Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository.https://vulnfeed.org/cve/CVE-2026-113372/https://vulnfeed.org/cve/CVE-2026-113372/Wed, 04 Nov 2026 20:18:56 +0000Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository. A party that holds the key can sign repository metadata as that repository.https://vulnfeed.org/cve/CVE-2026-113373/https://vulnfeed.org/cve/CVE-2026-113373/Wed, 04 Nov 2026 20:18:56 +0000Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.