Vulnerability Reportsonatype/nexus3:3.97.1-alpine

sonatype/nexus3:3.97.1-alpinesonatype/nexus3:3.97.1

digestsha256:ffed04698ded3565ca3b40f4abd063d59b63c2fbeb134170e095bc1197931cd5

Executive Summary

Last scanned: Oct 24, 2026

Threat ScoreSAFE• Pre-calculated threat score falls in the SAFE band.• Trust inputs mark the image as VERIFIED/TRUSTED from publisher sonatype and pinned by digest.• Vulnerability stats show exposed_total=2, but exposed_count_ge6=0 and exposed_max_severity=0.0.• No post-exploit findings are present (post_total=0), and the top exposed and post-exploit finding lists are empty.• No CVE IDs were provided in the top findings, so no specific CVE-based risk can be cited.

0/100SAFE

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is safe for production use. Vulnerability stats show 2 exposed findings, but exposed_count_ge6 is 0 and exposed_max_severity is 0.0, so they do not affect the SAFE verdict. There are no post-exploit findings and the top finding lists are empty, meaning no specific CVE-based risk was supplied for this image. The image is from a verified publisher and is pinned by digest, supporting its production suitability.

Vulnerabilities

Vulnerability Log

2 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-85091	NONE0	zlib 1.3.2-r0 fixed in 1.3.2-r1	0.4% Theoretical Threat	Not Applicable
CVE-2026-113730	NONE0	ognl:ognl 3.4.4 fixed in 3.4.13	—	Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.