CVE-2026-3329

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
Sonatype	Nexus Repository Manager	>= 3.0.0, < 3.93.0

References

https://help.sonatype.com/en/sonatype-nexus-repository-3-93-0-release-notes.htmlRelease Notes
https://support.sonatype.com/hc/en-us/articles/52482870409491Vendor Advisory

Timeline

Published: Jun 11, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-332904.3WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.10.0, an authorization flaw in updateComment allows an authenticate CVE-2026-332915.4Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, moderators can create Zendesk CVE-2026-332927.5WWBN AVideo is an open source video platform. Prior to version 26.0, the HLS streaming endpoint (`view/hls.php`) is vulnerable to a path tra CVE-2026-332938.1WWBN AVideo is an open source video platform. Prior to version 26.0, the `deleteDump` parameter in `plugin/CloneSite/cloneServer.json.php` i CVE-2026-332944.3WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (`plugin/BulkEmbed/save.json.php`)CVE-2026-332955.4WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CVE-2026-332966.1WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains an open redirect vulnerability in the login flow w CVE-2026-332979.1WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the CustomizeUser plugin allows CVE-2026-332987.8llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an integer overflow vulnerability in the `ggml_nbytes` function al CVE-2026-332995.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `N CVE-2026-33304.9The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection via the 'ip_search', 'startdate', 'enddate', 'username_search', CVE-2026-333006.5Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2