Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list
36added in the last 30 days
479new WordPress flaws this week
390,525entries in the database

40 results

  • Jul 14, 2026A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository CVE-2026-11403 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11High 8.7

    A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 17, 2026Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configuration that allows a delegated repositoryCVE-2026-10741 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11Medium 5.9

    Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configuration that allows a delegated repository administrator to disclose stored upstream proxy credentials.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 11, 2026A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoCVE-2026-3329 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11High 8.7

    A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 11, 2026An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiCVE-2026-3048 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11Medium 5.1

    An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiate unintended server-side connections when interacting with a malicious LDAP server.

    Product
    Nexus Repository
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 15, 2026CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network accessCVE-2026-5189 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11Critical 9.2

    CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration to be enabled.

    Product
    Nexus Repository
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 30, 2022Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF.CVE-2022-27907 · Other software · Sonatype · reported by MITREMedium 4.3

    Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 17, 2022Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection.CVE-2021-43961 · Other software · Sonatype · reported by MITREMedium 4.3

    Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 4, 2021Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request FoCVE-2021-43293 · Other software · Sonatype · reported by MITREMedium 4.3

    Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery (SSRF).

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 2, 2021Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account.CVE-2021-42568 · Other software · Sonatype · reported by MITREMedium 4.3

    Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 7, 2021Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection.CVE-2021-40143 · Other software · Sonatype · reported by MITREHigh 8.2

    Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 10, 2021Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0.CVE-2021-37152 · Other software · Sonatype · reported by MITREMedium 5.4

    Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the ability to add HTML files to a repository could redirect users to Nexus Repository Manager’s pages with code modifications.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 17, 2021Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via CVE-2021-34553 · Other software · Sonatype · reported by MITREMedium 4.3

    Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 28, 2021A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1.CVE-2021-29159 · Other software · Sonatype · reported by MITREMedium 6.1

    A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. An attacker with a local account can create entities with crafted properties that, when viewed by an administrator, can execute arbitrary JavaScript in the context of the NXRM application.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 26, 2021Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-related folder via directCVE-2021-30635 · Other software · Sonatype · reported by MITREMedium 5.3

    Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-related folder via directory traversal (no customer-specific data is exposed).

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 23, 2021Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control.CVE-2021-29158 · Other software · Sonatype · reported by MITREMedium 4.9

    Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 16, 2020Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via anCVE-2020-29436 · Other software · Sonatype · reported by MITREMedium 6.5

    Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Fixed in version 3.29.0.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 12, 2020A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19.CVE-2020-15012 · Other software · Sonatype · reported by MITREHigh 8.6

    A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can traverse up the file system to get access to content on disk (that the user running nxrm also has access to).

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 12, 2020Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.CVE-2020-15868 · Other software · Sonatype · reported by MITREHigh 7.5

    Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 31, 2020Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.CVE-2020-15871 · Other software · Sonatype · reported by MITREHigh 8.8

    Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 31, 2020Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2).CVE-2020-15870 · Other software · Sonatype · reported by MITREMedium 6.1

    Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2).

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 31, 2020Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2).CVE-2020-15869 · Other software · Sonatype · reported by MITREMedium 5.4

    Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2).

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 27, 2020An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1.CVE-2020-11415 · Other software · Sonatype · reported by MITREMedium 4.9

    An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Admin users can retrieve the LDAP server system username/password (as configured in nxrm) in cleartext.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 20, 2020An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0.CVE-2020-11753 · Other software · Sonatype · reported by MITREHigh 8.8

    An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or API. NOTE: in 3.22.0, scripting is disabled by default (making this not exploitable).

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 2, 2020Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.CVE-2020-11444 · Other software · Sonatype · reported by MITREHigh 8.8

    Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.

    Product
    Nexus
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 1, 2019There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE).CVE-2019-15588 · Other software · Sonatype · reported by support@hackerone.comHigh 7.2

    There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 21, 2019Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.CVE-2019-16530 · Other software · Sonatype · reported by MITREHigh 7.2

    Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.

    Product
    Nexus IQ Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 16, 2019Sonatype Nexus Repository Manager 2.x before 2.14.15 allows Remote Code Execution.CVE-2019-15893 · Other software · Sonatype · reported by MITREHigh 7.2

    Sonatype Nexus Repository Manager 2.x before 2.14.15 allows Remote Code Execution.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 3, 2019The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such asCVE-2019-5475 · Other software · Sonatype · reported by support@hackerone.comHigh 8.8

    The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 22, 2019In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS.CVE-2019-14469 · Other software · Sonatype · reported by MITREMedium 5.4

    In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 8, 2019Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images.CVE-2019-9630 · Other software · Sonatype · reported by MITREHigh 7.5

    Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 8, 2019Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).CVE-2019-9629 · Other software · Sonatype · reported by MITRECritical 9.8

    Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 7, 2019Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS.CVE-2019-11629 · Other software · Sonatype · reported by MITREMedium 6.1

    Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 21, 2019Sonatype Nexus Repository Manager Incorrect Access Control VulnerabilityCVE-2019-7238 · Other software · Sonatype · reported by MITREExploitedCritical 9.8

    Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.

    Product
    Nexus Repository Manager
    On CISA’s list since
    Dec 10, 2021 (federal fix deadline Jun 10, 2022)
    What to do
    Attackers are using this now. Install Sonatype’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
  • Nov 15, 2018Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.CVE-2018-16621 · Other software · Sonatype · reported by MITREHigh 7.2

    Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 15, 2018Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control.CVE-2018-16620 · Other software · Sonatype · reported by MITREHigh 7.5

    Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 15, 2018Sonatype Nexus Repository Manager before 3.14 allows XSS.CVE-2018-16619 · Other software · Sonatype · reported by MITREMedium 6.1

    Sonatype Nexus Repository Manager before 3.14 allows XSS.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 11, 2018Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI.CVE-2018-12100 · Other software · Sonatype · reported by MITREMedium 4.8

    Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 9, 2018Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 2.x before 2.14.6 allow remote attackers to inject arbitraryCVE-2018-5307 · Other software · Sonatype · reported by MITREMedium 6.1

    Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 2.x before 2.14.6 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; (3) the filename in the "File Upload" functionality of the Staging Upload; (4) the username when creating a new user; or (5) the IQ Server URL field in the IQ Server Connection functionality.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 9, 2018Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary weCVE-2018-5306 · Other software · Sonatype · reported by MITREMedium 6.1

    Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; (3) the filename in the "File Upload" functionality of the Staging Upload; (4) the username when creating a new user; or (5) the IQ Server URL field in the IQ Server Connection functionality.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 17, 2017Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature.CVE-2017-17717 · Other software · Sonatype · reported by MITRECritical 9.8

    Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature.

    Product
    Nexus Repository Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.