Package Search Help

You can use boolean logic (e.g. AND/OR/NOT) for complex search queries. For more help and examples, see the search documentation.

Search by package name:
my-package (implicit)
name:my-package (explicit)

Search by package filename:
filename:my-package.ext 

Search by package tag:
tag:latest 

Search by package version:
version:1.0.0  prerelease:true (prereleases)
prerelease:false (no prereleases)

Search by package architecture:
architecture:x86_64 

Search by package distribution:
distribution:el 

Search by package license:
license:MIT 

Search by package format:
format:deb 

Search by package status:
status:in_progress 

Search by package file checksum:
checksum:5afba 

Search by package security status:
severity:critical 

Search by package vulnerabilities:
vulnerabilities:>1 
vulnerabilities:<1000 

Search by # of package downloads:
downloads:>8 
downloads:<100 

Search by package type:
type:binary 
type:source 

Search by package size (bytes):
size:>50000 
size:<10000 

Search by dependency name/version:
dependency:log4j 
dependency:log4j=1.0.0 
dependency:log4j>1.0.0 

Search by uploaded date:
uploaded:>"1 day ago" 
uploaded:<"August 14, 2022 EST" 

Search by entitlement token (identifier):
entitlement:3lKPVJPosCsY 

Search by policy violation:
policy_violated:true
deny_policy_violated:true
license_policy_violated:true
vulnerability_policy_violated:true

Search by repository:
repository:repo-name

Search by last download date:
last_downloaded:<"30 days ago" 
last_downloaded:>"August 14, 2022 EST" 

Search queries for all Debian-specific (and related) package types

Search by component:
deb_component:unstable

Search queries for all Maven-specific (and related) package types

Search by group ID:
maven_group_id:org.apache

Search queries for all Docker-specific (and related) package types

Search by image digest:
docker_image_digest:sha256:7c5..6d4
(full hashref only)

Search by layer digest:
docker_layer_digest:sha256:4c4..ae4
(full hashref only)

Search queries for all Generic-specific package types

Search by file path:
generic_filepath:path/to/file.txt

Search by directory:
generic_directory:path/to

Field type modifiers (depending on the type, you can influence behaviour)

For all queries, you can use:
~foo for negation

For string queries, you can use:
^foo to anchor to start of term
foo$ to anchor to end of term
foo*bar for fuzzy matching

For number/date or version queries, you can use:
>foo for values greater than
>=foo for values greater / equal
<foo for values less than
<=foo for values less / equal

Need a secure and centralised artifact repository to deliver Alpine, Cargo, CocoaPods, Composer, Conan, Conda, CRAN, Dart, Debian, Docker, Generic, Go, Helm, Hex, HuggingFace, LuaRocks, Maven, MCP, npm, NuGet, P2, Python, RedHat, Ruby, Swift, Terraform, Vagrant, VSX, Raw & More packages?

Cloudsmith is the new standard in Package / Artifact Management and Software Distribution.

With support for all major package formats, you can trust us to manage your software supply chain.

Start My Free Trial
 Public tetrate tetrate (Tetrate) / getistio-containers
Tetrate Istio Distro project (formerly GetIstio) container images registry

Docker logo pilot  e85ed534bbb9e96b32d102e62e0…

One-liner (summary)

A certifiably-awesome package curated by Bender Rodriguez, hosted by Cloudsmith.

Description

A certifiably-awesome package curated by Bender Rodriguez, hosted by Cloudsmith.

License

Unknown

Size

31.3 MB

Downloads

0

Tags

new image arm64 linux

Status  Completed
Checksum (MD5) 9edcd1e416d247ac95658b7e4a538138
Checksum (SHA-1) 73e382d32b3419bdbfb799a849d311c457a78321
Checksum (SHA-256) e85ed534bbb9e96b32d102e62e0d2aae69d8bbe059eb679cc665c9ffce3d1f66
Checksum (SHA-512) e5beb5fb3ad022bf3814537d1ac7adaa462d2cf40e401a578168ba4a8eea1d2fe2…
GPG Signature
GPG Fingerprint 7490c226a7c21a19bb1d09e800b3a57eef287d7b
Storage Region  Dublin, Ireland
Type  Binary (contains binaries and binary artifacts)
Uploaded At 20 hours ago
Uploaded By tetrate-ci
Slug Id pilot-ann1
Unique Id piP6zX0Sj8Xv
Version (Raw) e85ed534bbb9e96b32d102e62e0d2aae69d8bbe059eb679cc665c9ffce3d1f66
Version (Parsed)
  • Type: Unknown
  docker-specific metadata
Image Digest sha256:e85ed534bbb9e96b32d102e62e0d2aae69d8bbe059eb679cc665c9ffce3d1f66
Config Digest sha256:18c8b2d282721fa002801565a19723430058f3703d48c8880fedac0d47049d47
V1 OCI Index Digest sha256:7dfb49c0a0b714e10191c67966183fa0350744e1b9a13e7cfd9a46bf9a56567c
V1 Distribution (Signed) Digest sha256:7452d4a5d6b777ce946a6c277dda956295150a9b732e4304a1b125490616a21c
V1 OCI Digest sha256:51de65af6e3813e39c1e756226c809f98df89f9bb2629af7e3d783c75918f36a
V2 Distribution List Digest sha256:b84be4934dd26023f39dead28e7cf50135c03e6141c1e6e65c3027852339ff13
V1 Distribution Digest sha256:97dc81f3cc9b3ec932218058433d30c07f98a0a017bca01e96308e09ebfe0c66
V2 Distribution Digest sha256:e85ed534bbb9e96b32d102e62e0d2aae69d8bbe059eb679cc665c9ffce3d1f66
  extended metadata
Manifest Type V2 Distribution
Architecture arm64
Author github.com/chainguard-dev/apko
Config
Created 2026-07-20 17:51:29 UTC
Os linux

This package was uploaded with the following V2 Distribution manifest:

{"schemaVersion":2,"mediaType":"application/vnd.docker.distribution.manifest.v2+json","config":{"mediaType":"application/vnd.docker.container.image.v1+json","size":2832,"digest":"sha256:57768f1a0dffed6fdca7080a68231fcec93812b197007012d0ec923a620032a8"},"layers":[{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","size":742072,"digest":"sha256:bb0a38e3921131fee8a37a33b012d6a0e1b2ca1feaaf826df871f7128ca8e2e9"},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","size":513,"digest":"sha256:b2e1228fe32053c2c8e3f46bcdb2324688f3367892e37df2dba5beb48fcf2d05"},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","size":481,"digest":"sha256:235b743aca129c9e0192895bb69a0b97a11823ffb43c471b3f1bfa38c8ac8308"},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","size":39,"digest":"sha256:89732bc7504122601f40269fc9ddfb70982e633ea9caf641ae45736f2846b004"},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","size":32029224,"digest":"sha256:fedec45de5d47589e38164d20c4d52f95bf36f799786831e846da0f4b1182b3f"}]}
Digest: sha256:bb0a38e3921131fee8a37a33b012d6a0e1b2ca1feaaf826df871f7128ca8e2e9
Command: apko
724.7 KB
Digest: sha256:b2e1228fe32053c2c8e3f46bcdb2324688f3367892e37df2dba5beb48fcf2d05
Command: COPY /home/etc/passwd /etc/passwd # buildkit
513 bytes
Digest: sha256:235b743aca129c9e0192895bb69a0b97a11823ffb43c471b3f1bfa38c8ac8308
Command: COPY /home/etc/group /etc/group # buildkit
481 bytes
Digest: sha256:89732bc7504122601f40269fc9ddfb70982e633ea9caf641ae45736f2846b004
Command: COPY /home/nonroot /home/nonroot # buildkit
39 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: WORKDIR /
32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ARG TARGETARCH
32 bytes
Digest: sha256:fedec45de5d47589e38164d20c4d52f95bf36f799786831e846da0f4b1182b3f
Command: COPY arm64/pilot-discovery /usr/local/bin/pilot-discovery # buildkit
30.5 MB
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: USER 1337:1337
32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ENTRYPOINT ["/usr/local/bin/pilot-discovery"]
32 bytes
Docker logo
pilot
image arm64 linux
2 tetrate-ci
Docker logo
pilot
image arm64 linux
120.2 MB 3 months ago
27535 tetrate-ci
Docker logo
pilot
image amd64 linux
121.8 MB 3 months ago
19044 tetrate-ci
Docker logo
pilot
image arm64 linux
69.5 MB 3 months ago
139 tetrate-ci
Docker logo
pilot
image amd64 linux
35.7 MB 3 months ago
2 tetrate-ci
Docker logo
pilot
image arm64 linux
27604 tetrate-ci
Docker logo
pilot
image arm64 linux
27591 tetrate-ci
Docker logo
pilot
image arm64 linux
138 tetrate-ci
Docker logo
pilot
image amd64 linux
283 tetrate-ci
Docker logo
pilot
image amd64 linux
1 tetrate-ci
Docker logo
pilot
new image arm64 linux
31.3 MB 20 hours ago
0 tetrate-ci
Docker logo
pilot
new image arm64 linux
71.0 MB 12 hours ago
0 tetrate-ci
Docker logo
pilot
new image amd64 linux
37.0 MB 12 hours ago
0 tetrate-ci
Docker logo
pilot
new image arm64 linux
33.0 MB 12 hours ago
0 tetrate-ci
Docker logo
pilot
new image amd64 linux
117.6 MB 12 hours ago
0 tetrate-ci
Docker logo
pilot
new image arm64 linux
113.9 MB 12 hours ago
0 tetrate-ci
Docker logo
pilot
new image amd64 linux
35.2 MB 17 hours ago
0 tetrate-ci
Docker logo
pilot
new image arm64 linux
31.4 MB 17 hours ago
0 tetrate-ci
Docker logo
pilot
new image amd64 linux
115.8 MB 17 hours ago
1 tetrate-ci
Docker logo
pilot
new image arm64 linux
112.3 MB 17 hours ago
1 tetrate-ci

Last scanned

20 hours ago

Scan result

Vulnerable

Vulnerability count

6

Max. severity

High
Target: usr/local/bin/pilot-discovery
HIGH

CVE-2026-42151: github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

Package Name: github.com/prometheus/prometheus
Installed Version: v0.303.1
Fixed Version: 0.311.3

References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com nvd.nist.gov security.access.redhat.com www.cve.org
HIGH

CVE-2026-42154: github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.

Package Name: github.com/prometheus/prometheus
Installed Version: v0.303.1
Fixed Version: 0.311.3, 0.305.2

References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com nvd.nist.gov security.access.redhat.com www.cve.org
MEDIUM

CVE-2026-40179: Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration, data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions 3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g., --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested; and refrain from clicking untrusted links, particularly those containing functions such as label_replace, as they may generate poisoned label names and values.

Package Name: github.com/prometheus/prometheus
Installed Version: v0.303.1
Fixed Version: 0.311.2-0.20260410083055-07c6232d159b

References: github.com github.com github.com github.com nvd.nist.gov
MEDIUM

CVE-2026-44903: Prometheus is an open-source monitoring system and time series databas ...

Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3.

Package Name: github.com/prometheus/prometheus
Installed Version: v0.303.1
Fixed Version: 0.311.3

References: github.com github.com github.com nvd.nist.gov
UNKNOWN

GO-2026-5932: The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

Package Name: golang.org/x/crypto
Installed Version: v0.53.0
Fixed Version:

References: go.dev pkg.go.dev
UNKNOWN

CVE-2026-56852: Infinite loop on invalid input in golang.org/x/text

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Package Name: golang.org/x/text
Installed Version: v0.38.0
Fixed Version: 0.39.0

References: go.dev go.dev pkg.go.dev

These instructions assume you have setup the repository first (or read it).

To pull pilot @ reference/tag sha256:e85ed534bbb9e96b32d102e62e0d2aae69d8bbe059eb679cc665c9ffce3d1f66:

docker pull containers.istio.tetratelabs.com/pilot@sha256:e85ed534bbb9e96b32d102e62e0d2aae69d8bbe059eb679cc665c9ffce3d1f66

You can also pull the latest version of this image (if it exists):

docker pull containers.istio.tetratelabs.com/pilot:latest

To refer to this image after pulling in a Dockerfile, specify the following:

FROM containers.istio.tetratelabs.com/pilot@sha256:e85ed534bbb9e96b32d102e62e0d2aae69d8bbe059eb679cc665c9ffce3d1f66
Top