Docker Hub Image Vulnerability Scanner

Pricing

Rating

Developer

Actor stats

Categories

Share

Scans Docker Hub image tags for metadata and queries public CVE databases to produce a vulnerability report.

What it does

This Actor takes a list of Docker image references (e.g., nginx:alpine, python:3.11-slim) and returns:

• Image metadata from Docker Hub: name, description, pull count, last pushed, official status, tag list, architectures, size.
• Inferred base OS/distribution from the tag name (e.g., bookworm, alpine3.18, noble).
• Vulnerability findings from:
  • NVD — NIST National Vulnerability Database (CVE records, CVSS scores)
  • OSV.dev — Open Source Vulnerabilities database (package-level CVEs, fixed-in versions)
  • CISA KEV — Known Exploited Vulnerabilities catalog
• Optional deep scan — pulls image manifests and layer blobs to enumerate installed OS packages (dpkg/apk) and query OSV for package-level CVEs.

Input

{
"images":["nginx:alpine","python:3.11-bookworm","bitnami/redis:7.0"],
"includeMetadata":true,
"cveSources":["nvd","osv","cisa-kev"],
"minSeverity":"HIGH",
"maxCvesPerImage":50,
"includeManifest":false,
"deepScan":false
}

Output

One dataset item per image:

{
"image":"nginx:alpine",
"normalizedImage":"library/nginx:alpine",
"success":true,
"scanConfidence":"heuristic",
"dataSources":["nvd","osv","cisa-kev"],
"metadata":{
"name":"nginx",
"description":"Official build of Nginx.",
"lastPushed":"3 days ago",
"pullCount":16188286,
"official":true,
"tags":[...]
},
"inferredBase":"Alpine Linux",
"cveSummary":{"CRITICAL":1,"HIGH":1,"MEDIUM":0,"LOW":0,"UNKNOWN":0},
"topVulnerabilities":[
{
"id":"CVE-2025-34203",
"severity":"CRITICAL",
"score":9.8,
"description":"...",
"dataSource":"nvd"
}
]
}

With deepScan enabled, the output also contains imageConfig and packages:

{
"scanConfidence":"deep",
"imageConfig":{"architecture":"amd64","os":"linux"},
"packages":[
{
"name":"openssl",
"version":"3.0.11-1~deb12u2",
"ecosystem":"Debian",
"vulnerabilities":[...]
}
]
}

Pricing

Pay Per Event — charged per image scanned.

Limitations

This Actor performs metadata/heuristic scanning by default. It does not pull image layers unless Deep scan is enabled. Deep scan improves accuracy by enumerating dpkg/apk packages and querying OSV, but it is still slower and consumes Docker Hub pull limits.

NVD availability can vary; the Actor automatically retries transient errors and falls back to OSV and CISA KEV when NVD is slow or unavailable.