alloy v1.20.1-tpio.1 trivy
Critical0
High0
Medium65
Low7
publish scan at 2026-10-15T16:38:48Z. Digest: sha256:35bdbba83eb9c00865086af3284ca94b4393191cc2878a8f5969a511d480bcf2.
Predicates verified from the signed registry attestations.
Predicate type: https://thepeoples.io/attestations/trivy-report/v1. SHA-256 of original predicate (compact JSON plus newline): fe02b754fe7a8a4b42ea99ce4d36d0306998f070949490d9fc8951c931efa42b.
cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://thepeoples.io/attestations/trivy-report/v1 oci.thepeoples.io/hardened/alloy@sha256:35bdbba83eb9c00865086af3284ca94b4393191cc2878a8f5969a511d480bcf2 | jq -r '.payload' | base64 -d | jq -c '.predicate' | sha256sum| CVE-2026-18374 | libc-bin | 2.39-0ubuntu8.9 | not available | MEDIUM | not supplied |
| CVE-2026-89092 | libc-bin | 2.39-0ubuntu8.9 | not available | MEDIUM | not supplied |
| CVE-2026-18374 | libc6 | 2.39-0ubuntu8.9 | not available | MEDIUM | not supplied |
| CVE-2026-89092 | libc6 | 2.39-0ubuntu8.9 | not available | MEDIUM | not supplied |
| CVE-2026-103111 | libpcre2-8-0 | 10.42-4ubuntu2.1 | not available | MEDIUM | not supplied |
| CVE-2026-86145 | libpcre2-8-0 | 10.42-4ubuntu2.1 | not available | MEDIUM | not supplied |
| CVE-2026-89156 | libpcre2-8-0 | 10.42-4ubuntu2.1 | not available | MEDIUM | not supplied |
| CVE-2026-89157 | libpcre2-8-0 | 10.42-4ubuntu2.1 | not available | MEDIUM | not supplied |
| CVE-2026-89158 | libpcre2-8-0 | 10.42-4ubuntu2.1 | not available | MEDIUM | not supplied |
| CVE-2026-89160 | libpcre2-8-0 | 10.42-4ubuntu2.1 | not available | MEDIUM | not supplied |
| CVE-2026-89161 | libpcre2-8-0 | 10.42-4ubuntu2.1 | not available | MEDIUM | not supplied |
| CVE-2026-40228 | libsystemd0 | 255.4-1ubuntu8.17 | not available | LOW | not supplied |
| CVE-2026-40228 | libudev1 | 255.4-1ubuntu8.17 | not available | LOW | not supplied |
| CVE-2024-56433 | login | 1:4.13+dfsg1-4ubuntu3.2 | not available | LOW | not supplied |
| CVE-2024-56433 | passwd | 1:4.13+dfsg1-4ubuntu3.2 | not available | LOW | not supplied |
| CVE-2026-18477 | tar | 1.35+dfsg-3ubuntu0.4 | not available | MEDIUM | not supplied |
| CVE-2026-18508 | tar | 1.35+dfsg-3ubuntu0.4 | not available | MEDIUM | not supplied |
| CVE-2026-85091 | zlib1g | 1:1.3.dfsg-3.1ubuntu2.2 | not available | MEDIUM | not supplied |
| CVE-2026-21726 | github.com/grafana/loki/v3 | v3.0.0-20260915071729-5cf8c23a258d | 3.6.4 | MEDIUM | not supplied |
| CVE-2026-86597 | github.com/snowflakedb/gosnowflake | v1.19.1 | not available | MEDIUM | not supplied |
| GO-2026-5932 | golang.org/x/crypto | v0.57.0 | not available | UNKNOWN | not supplied |
21 findings, including suppressed matches where reported.