Vulnerability Reportsonatype/nexus3:3.98.0-alpine

sonatype/nexus3:latestsonatype/nexus3:3.98.0sonatype/nexus3:3.98.0-alpine

digestsha256:26aaefb94d3fae6d18161a26a9eb5cdf25ce9401ea095f41e8ad5e5cf86b3a20

Executive Summary

Last scanned: Nov 4, 2026

Threat ScoreSAFE• The scan found one reachable-from-network finding, and its severity is low, so it does not affect the verdict.• No findings were rated high or critical, and none are listed as actively exploited in the wild.• The image is published by a verified vendor and is pinned by digest, which supports a stable, traceable deployment.• The one low-severity finding matters only in limited circumstances and does not drive the risk picture for this container.

0/100SAFE

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is safe for production use. The scan found a single low-severity issue that is not tied to any serious impact in this container, so it does not change the overall picture. Routine patching and standard hardening, such as keeping the service behind appropriate network controls, remain good practice for any deployment.

Already in good shape · 2 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

1 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-113730	LOW3.36	ognl:ognl 3.4.4 fixed in 3.4.13	0.4% Theoretical Threat	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.