Which CVEs affect your Artifactory, Nexus Repository or Harbor version?

Every known CVE for the version you run, its end of life and how far behind the latest release it is, from NVD and the vendors' own records.

Paste the version your server reports. Build suffixes such as -03 and a leading v are fine.

Not sure which version you run? A Nexus server can report it in its Server header. curl -sI https://your-nexus-host/ | grep -i '^server:' prints a line like Server: Nexus/3.76.0-03 (OSS). Paste that line here.

Tired of patching your own repository server?

This is what we do. We host your Maven, npm, PyPI and Docker repositories, so there's no Nexus, Artifactory or Harbor server to upgrade or patch.

Our migration tool is free to use with CloudRepo.

Start free trial

14 days free. No credit card required.

Or book a call with Chris

Browse by product

How the answer is built

Each CVE carries two verdicts, never merged: what NVD's exact CPE match for the version says, and what the vendor's own CVE record says. NVD has not analyzed every record (a CVE can be Deferred with no version configuration at all), and the vendor's list is the one that names the fix on each branch, so a page counts a CVE when either source says affected and shows both columns side by side.

Release dates, end-of-life status and the latest version come from the vendor's own release and end-of-life pages. A version the vendor never listed gets no page; the checker says so and points at the nearest known versions. Versions with no known CVE are listed on the product index without a page.

Sources: NVD (exact CPE match and the published configurations), the CVE Program record (the vendor's CNA entry with its affected and fixed versions), JFrog's security advisories, release notes and end-of-life page, Sonatype's security advisories, release notes and end-of-life page, the Harbor project's security advisories, release notes and end-of-life page. Pulled October 23, 2026. Every CVE row links to its NVD record and to the vendor's advisory.

Next

This page is not a scan of your server: the data is NVD's and the vendor's, linked on every row, pulled on October 23, 2026.