CVE-2026-3048

LowCVSS 3.8/10Last modified Oct 26, 2026

Description

An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiate unintended server-side connections when interacting with a malicious LDAP server.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-502CWE-918

Affected software

VendorProductVersions
SonatypeNexus Repository>= 3.0.0, < 3.92.0

References

Timeline

Published
May 11, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-304806.5A Local File Inclusion (LFI) vulnerability in the NFSen module (nfsen.inc.php) of LibreNMS 22.11.0-23-gd091788f2 allows authenticated attackCVE-2026-30496.1A vulnerability was detected in horilla-opensource horilla up to 1.0.2. This issue affects the function get of the file horilla_generics/gloCVE-2026-304958.8The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP port 5555 over the CVE-2026-304969.8The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP API on TCP port 2345 that allows full unautheCVE-2026-304986.3A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the delete.php endpoint of Jason2605 AdminPanel 4.0.CVE-2026-30505.4A flaw has been found in horilla-opensource horilla up to 1.0.2. Impacted is an unknown function of the file static/assets/js/global.js of tCVE-2026-30517.6A vulnerability has been found in DataLinkDC dinky up to 1.2.5. The affected element is the function getProjectDir of the file dinky-admin/sCVE-2026-305127.8A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode implementation of Scheidt & Bachmann entervo HMI priCVE-2026-30527.7A vulnerability was found in DataLinkDC dinky up to 1.2.5. The impacted element is the function proxyUba of the file dinky-admin/src/main/jaCVE-2026-305205.4A Blind SQL Injection vulnerability exists in SourceCodester Loan Management System v1.0. The vulnerability is located in the ajax.php file CVE-2026-305216.5A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application CVE-2026-305226.5A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application
CVE-2026-3048: Low severity, CVSS 3.8 | Vulnix