https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T08:22:31.154219+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-338036 EUVD-2026-338036 2026-10-04T08:22:31.203451+00:00 EUVD-2026-338036 https://cve.radiocsirt.org/vuln/fkie_cve-2026-14645 fkie_cve-2026-14645 2026-10-04T08:22:31.203489+00:00

Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations (Server-Side Request Forgery). This permission is granted by role assignment, independent of authentication status, so an unauthenticated user could also trigger this behavior if the anonymous role has been granted the permission.

 https://cve.radiocsirt.org/vuln/ghsa-7364-vc59-2428 GHSA-7364-vc59-2428 2026-10-04T08:22:31.203525+00:00

Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations (Server-Side Request Forgery). This permission is granted by role assignment, independent of authentication status, so an unauthenticated user could also trigger this behavior if the anonymous role has been granted the permission.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2360 WID-SEC-W-2026-2360 — Sonatype Nexus Repository Manager: Mehrere Schwachstellen 2026-10-04T08:22:31.203545+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Sonatype Nexus Repository Manager ausnutzen, um Sicherheitsmaßnahmen zu umgehen, um Informationen offenzulegen und ggf. Daten zu manipulieren.