Security vendor · Software composition analysis · in CISA KEV
Sonatype in the CISA KEV catalog
CISA’s Known Exploited Vulnerabilities catalog lists 2 entries for Sonatype as of catalog version 2026.11.06, released November 6, 2026. The newest was added December 10, 2021, and the latest federal due date is June 10, 2022.
Updated
- entries in the catalog
- 2
- newest addition
- December 10, 2021
- latest federal due date
- June 10, 2022
- marked known ransomware use
- 0
Directory record
- Website
- www.sonatype.com
- Categories
- Software composition analysis (primary), Software supply chain security
- Headquarters
- Fulton, United States
- Founded
- Not established
- Ownership
- Ownership not established
- Company record
- Sonatype on CISO Tribune
Directory data as of November 8, 2026. What the company sells, and the source for every fact, is on its CISO Tribune page.
KEV entries, newest first
Filed by CISA under the name “Sonatype”. Each row links to the CVE’s NVD record; entries added in the last 45 days also link to their place on must-patch. The due date is CISA’s remediation deadline for federal civilian agencies, as the feed states it.
Added December 10, 2021
CVE-2019-7238 Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability
Nexus Repository Manager
Due June 10, 2022
Added November 3, 2021
CVE-2020-10199 Sonatype Nexus Repository Remote Code Execution Vulnerability
Nexus Repository
Due May 3, 2022
Snapshot of CISA’s feed taken November 7, 2026; the whole catalog is counted on the KEV tracker.
On Daily CISO, newest first
No briefing or archive item names Sonatype yet. Every item about a security vendor is on the vendor news page.
Sources
- Cybersecurity and Infrastructure Security Agency, KEV catalog · primary source
- Cybersecurity and Infrastructure Security Agency, KEV JSON feed (catalog version 2026.11.06), published November 6, 2026 · primary source
- CISO Tribune, vendor directory record for Sonatype, published November 8, 2026