cosmo 0.22.0 Helm chart

Name: cosmo Helm chart 0.22.0: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

cosmo-platform

Scored 13 Oct 2026

This is the official Helm Chart for WunderGraph Cosmo - The Full Lifecycle GraphQL API Management Solution.

Version 0.22.0App version not verified against the render 2Artifact Hub

cosmo 0.22.0 deploys 10 container images: ghcr.io/wundergraph/cosmo/cdn, ghcr.io/wundergraph/cosmo/controlplane, ghcr.io/wundergraph/cosmo/graphqlmetrics, bitnamilegacy/minio and 6 more. Across them, 2,995 findings — 17 critical, 12 high — 2 on CISA KEV. The highest contribution is BIT-redis-2025-49844 in Redis(R) 7.2.4-5, fixed in 6.2.20.

Radar Score

35,52917125572,407

2,995 findings over 10 of 10 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

10 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/wundergraph/cosmo/cdn	0.14.1	0029235	2,712
ghcr.io/wundergraph/cosmo/controlplane×5	0.133.1	2269285	4,335
ghcr.io/wundergraph/cosmo/graphqlmetrics	0.33.0	1041143	2,275
bitnamilegacy/minio	2025.7.23-debian-12-r5	1084322	4,723
ghcr.io/wundergraph/cosmo/otelcollector	0.18.1	22103524	7,001
ghcr.io/wundergraph/cosmo/studio	0.111.0	2141209	3,052
bitnamilegacy/clickhouse	24.6.2-debian-12-r3	1253203	3,064
ghcr.io/wundergraph/cosmo/keycloak	0.13.0	0025117	1,615
bitnamilegacy/postgresql	15.4.0-debian-11-r45	4031123	2,180
bitnamilegacy/redis×2	7.2.4-debian-12-r16	4581246	4,573

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

1,131 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	DEBIAN-CVE-2026-58470	wget@1.21.3-1+b2	no fix listed
Low	DEBIAN-CVE-2026-67693	gnutls28@3.7.9-2+deb12u2	no fix listed
Low	GHSA-m454-3xv7-qj85	github.com/ClickHouse/ch-go@v0.61.5	0.65.0
Low	GHSA-rj75-hqrm-r3gf	postcss-selector-parser@6.1.2	7.1.6
Low	DSA-5650-1	util-linux@2.36.1-8+deb11u1	2.36.1-8+deb11u2
Low	GHSA-hfvc-g4fc-pqhx	go.opentelemetry.io/otel/sdk@v1.28.0	1.43.0
Low	GHSA-38f8-5428-x5cv	netty-codec-http@4.1.130.Final	4.1.133.Final
Low	GHSA-52v5-jr5w-gjxr	sigstore@3.0.0	4.1.1
Low	GHSA-qxvw-fvwx-5cp7	mariadb-java-client@3.5.6	3.5.9
Low	DEBIAN-CVE-2026-60001	openssh@1:9.2p1-2+deb12u4	no fix listed
Low	GHSA-7q8q-rj6j-mhjq	axios@1.8.4	1.18.0
Low	GO-2026-5775	github.com/go-chi/chi/v5@v5.0.12	5.3.0
Low	GHSA-4633-3j49-mh5q	next@15.2.4	15.5.21
Low	GHSA-g6gw-c38x-mqfc	hono@4.6.12	4.13.5
Low	GHSA-wjgm-6hv5-3cvf	jackson-databind@2.19.2	2.21.6
Low	GO-2026-4603	stdlib@go1.21.10	1.25.8
Low	DLA-4064-1	libxml2@2.9.10+dfsg-6.7+deb11u4	2.9.10+dfsg-6.7+deb11u6
Low	DEBIAN-CVE-2026-3783	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15
Low	GHSA-563q-j3cm-6jxm	netty-codec-http2@4.1.130.Final	4.1.135.Final
Low	GO-2025-4175	stdlib@go1.21.10	1.24.11
Low	GHSA-qc2q-p7wx-3px3	google.golang.org/grpc@v1.71.0	1.83.1
Low	DSA-5883-1	mercurial@6.3.2-1	6.3.2-1+deb12u1
Low	GHSA-9vqf-7f2p-gf9v	hono@4.6.12	4.12.16
Low	GHSA-qpw4-5x99-6vjp	golang.org/x/crypto@v0.31.0	0.52.0
Low	GHSA-9m57-25v3-79x9	golang.org/x/crypto@v0.31.0	0.52.0
Low	GHSA-3vhc-576x-3qv4	hono@4.6.12	4.11.4
Low	GO-2026-4864	stdlib@go1.21.10	1.25.9
Low	GO-2026-6179	golang.org/x/mod@v0.17.0	0.40.0
Low	DLA-4437-1	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3
Low	DEBIAN-CVE-2024-22365	pam@1.5.2-6+deb12u1	1.5.2-6+deb12u2
Low	DEBIAN-CVE-2026-6429	curl@7.88.1-10+deb12u12	no fix listed
Low	GHSA-v2v4-37r5-5v8g	ip-address@9.0.5	10.1.1
Low	GHSA-f6x5-jh6r-wrfv	golang.org/x/crypto@v0.31.0	0.45.0
Low	DEBIAN-CVE-2025-15367	python3.11@3.11.2-6+deb12u5	no fix listed
Low	GHSA-6wqw-2p9w-4vw4	hono@4.6.12	4.11.7
Low	GO-2026-4865	stdlib@go1.21.10	1.25.9
Low	GO-2026-4982	stdlib@go1.21.10	1.25.10
Low	GO-2026-5025	golang.org/x/net@v0.33.0	0.55.0
Low	GHSA-3v7f-55p6-f55p	picomatch@2.3.1	2.3.2
Low	GHSA-5x3r-wrvg-rp6q	netty-codec-http2@4.1.130.Final	4.1.135.Final
Low	GHSA-gvwx-54wh-qm9j	tar@7.4.3	7.5.17
Low	DEBIAN-CVE-2026-86143	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed
Low	GHSA-h3mg-xc3c-68pw	ip-address@9.0.5	10.7.1
Low	DEBIAN-CVE-2026-86140	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed
Low	DEBIAN-CVE-2026-86142	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed
Low	GHSA-3rh2-v3gr-35p9	github.com/minio/minio@v0.0.0-20250723155402-7ced9663e6a7	no fix listed
Low	DEBIAN-CVE-2025-10148	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15
Low	GHSA-w62v-xxxg-mg59	hono@4.6.12	4.12.27
Low	GHSA-83g3-92jg-28cx	tar@7.4.3	7.5.8
Low	DEBIAN-CVE-2026-78410	util-linux@2.38.1-5+deb12u1	no fix listed

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.22.1latest	—	—	—	—
0.22.0	—	—	17125572,407	35,529
0.21.0	—	—	17125572,407	35,529
0.20.0	—	—	17125572,407	35,529

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/cosmo-platform/cosmo.svg)](https://charts.stackradar.io/charts/cosmo-platform/cosmo)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.