Vulnerability Reportsonatype/nexus3:3.98.1

sonatype/nexus3:latestsonatype/nexus3:3.98.1sonatype/nexus3:3.98.1-alpine

digestsha256:91a9af44af777c353db11a5ee73850c7eb24b03c997ff4cc62a3500ad38a1332

Executive Summary

Last scanned: Nov 7, 2026

Threat ScoreSAFE• The scan found one reachable-from-network finding with a maximum severity of 3.36, which is low and does not reach the threshold for concern in this container.• No findings are known to be actively exploited, and no high-severity issues were identified in the reachable services.• Post-compromise exposure shows no findings, so an attacker who already had access would not gain additional vulnerable components from this image.• The publisher is verified and the image is pinned by digest, which supports a stable, tamper-resistant supply chain; the reputation verdict is TRUSTED.• The container runs as a non-root user (nexus) and exposes only port 8081, which limits the surface an attacker can reach.

0/100SAFE

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is safe for production use. The scan found one low-severity issue that is reachable from the network, but its severity is low and it does not affect the verdict. No exploitable high-severity or actively exploited vulnerabilities were identified, and the image comes from a verified publisher and is pinned by digest. Routine patching and periodic rescanning are still good practice as new findings emerge.

Already in good shape · 2 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

1 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-113730	LOW3.36	ognl:ognl 3.4.4 fixed in 3.4.13	0.4% Theoretical Threat	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.