XSS in Sonatype Nexus Repository

CVE-2026-3438

A reflected cross-site scripting vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2 that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.005 (37.5th percentile) — read the EPSS interpretation.