cosmo 0.22.0 Helm chart

Name: cosmo Helm chart 0.22.0: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

cosmo-platform

Scored 13 Oct 2026

This is the official Helm Chart for WunderGraph Cosmo - The Full Lifecycle GraphQL API Management Solution.

Version 0.22.0App version not verified against the render 2Artifact Hub

cosmo 0.22.0 deploys 10 container images: ghcr.io/wundergraph/cosmo/cdn, ghcr.io/wundergraph/cosmo/controlplane, ghcr.io/wundergraph/cosmo/graphqlmetrics, bitnamilegacy/minio and 6 more. Across them, 2,995 findings — 17 critical, 12 high — 2 on CISA KEV. The highest contribution is BIT-redis-2025-49844 in Redis(R) 7.2.4-5, fixed in 6.2.20.

Radar Score

35,52917125572,407

2,995 findings over 10 of 10 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

10 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/wundergraph/cosmo/cdn	0.14.1	0029235	2,712
ghcr.io/wundergraph/cosmo/controlplane×5	0.133.1	2269285	4,335
ghcr.io/wundergraph/cosmo/graphqlmetrics	0.33.0	1041143	2,275
bitnamilegacy/minio	2025.7.23-debian-12-r5	1084322	4,723
ghcr.io/wundergraph/cosmo/otelcollector	0.18.1	22103524	7,001
ghcr.io/wundergraph/cosmo/studio	0.111.0	2141209	3,052
bitnamilegacy/clickhouse	24.6.2-debian-12-r3	1253203	3,064
ghcr.io/wundergraph/cosmo/keycloak	0.13.0	0025117	1,615
bitnamilegacy/postgresql	15.4.0-debian-11-r45	4031123	2,179
bitnamilegacy/redis×2	7.2.4-debian-12-r16	4581246	4,573

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

1,420 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	GO-2024-2598	stdlib@go1.20.7	1.21.8
Low	DEBIAN-CVE-2026-42015	gnutls28@3.7.9-2+deb12u2	3.7.9-2+deb12u7
Low	DEBIAN-CVE-2026-35387	openssh@1:9.2p1-2+deb12u4	1:9.2p1-2+deb12u10
Low	DEBIAN-CVE-2025-5245	binutils@2.40-2	no fix listed
Low	GHSA-9fr6-4gfg-395g	axios@1.8.4	1.20.0
Low	GHSA-vh66-26gq-q6x8	axios@1.8.4	1.20.0
Low	DEBIAN-CVE-2026-19499	glibc@2.36-9+deb12u7	no fix listed
Low	RHSA-2026:42952	glibc@2.34-231.el9_7.10	0:2.34-274.el9_8
Low	GHSA-574f-3g2m-x479	bcprov-jdk18on@1.82	1.84
Low	GHSA-45gg-vh54-h5m9	golang.org/x/crypto@v0.31.0	0.52.0
Low	DEBIAN-CVE-2025-5244	binutils@2.40-2	no fix listed
Low	GO-2023-2186	stdlib@go1.20.7	1.20.11
Low	DEBIAN-CVE-2025-7545	binutils@2.40-2	no fix listed
Low	DEBIAN-CVE-2018-1000021	git@1:2.39.5-0+deb12u2	no fix listed
Low	GHSA-968p-4wvh-cqc8	@babel/runtime@7.24.5	7.26.10
Low	GHSA-72hv-8253-57qq	jackson-core@2.19.2	2.21.1
Low	GHSA-xxqh-mfjm-7mv9	netty-codec-http@4.1.130.Final	4.1.133.Final
Low	GO-2026-6613	stdlib@go1.21.10	1.26.9
Low	DEBIAN-CVE-2026-76642	util-linux@2.38.1-5+deb12u1	no fix listed
Low	DEBIAN-CVE-2025-70873	sqlite3@3.40.1-2+deb12u1	no fix listed
Low	DEBIAN-CVE-2026-9547	curl@7.88.1-10+deb12u12	no fix listed
Low	GO-2025-3849	stdlib@go1.21.10	1.23.12
Low	GHSA-c2gf-v879-257j	netty-codec-http2@4.1.130.Final	4.1.135.Final
Low	GHSA-ggv3-7p47-pfv8	next@15.2.4	15.5.13
Low	DEBIAN-CVE-2025-66866	binutils@2.40-2	no fix listed
Low	GHSA-3p68-rc4w-qgx5	axios@1.8.4	1.15.0
Low	GHSA-4c39-4ccg-62r3	next@15.2.4	15.5.21
Low	GHSA-c69g-56f8-xwqj	netty-codec-http2@4.1.130.Final	4.1.136.Final
Low	GO-2026-6605	stdlib@go1.21.10	1.26.9
Low	GHSA-42h9-826w-cgv3	axios@1.8.4	1.18.0
Low	GHSA-pmv8-rq9r-6j72	axios@1.8.4	1.18.0
Low	GHSA-j92g-9f8w-j867	postgresql@42.7.7	42.7.12
Low	DEBIAN-CVE-2021-45346	sqlite3@3.40.1-2+deb12u1	no fix listed
Low	DEBIAN-CVE-2026-35414	openssh@1:9.2p1-2+deb12u4	1:9.2p1-2+deb12u10
Low	DEBIAN-CVE-2026-3784	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15
Low	DSA-6015-1	openssl@3.0.11-1~deb12u2	3.0.17-1~deb12u3
Low	DSA-5931-1	systemd@252.22-1~deb12u1	252.38-1~deb12u1
Low	GO-2026-6610	golang.org/x/net@v0.33.0	0.60.0
Low	GO-2026-6610	stdlib@go1.21.10	1.26.9
Low	GHSA-33j3-g875-37rp	keycloak-services@26.5.4	26.6.3
Low	GHSA-955p-x3mx-jcvp	next@15.2.4	15.5.21
Low	DEBIAN-CVE-2025-8941	pam@1.5.2-6+deb12u1	no fix listed
Low	GHSA-xmv7-r254-6q78	netty-resolver-dns@4.1.130.Final	4.1.135.Final
Low	GHSA-5cv4-jp36-h3mw	golang.org/x/net@v0.33.0	0.55.0
Low	BIT-gdal-2026-8086	GDAL@3.7.2	3.13.0
Low	GHSA-cphf-4846-3xx9	vertx-core@4.5.23	4.5.24
Low	GHSA-gx83-3vf8-gh7j	jackson-databind@2.19.2	2.21.6
Low	GO-2026-6180	golang.org/x/mod@v0.17.0	0.40.0
Low	DEBIAN-CVE-2026-1299	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u7
Low	GHSA-m32f-8vh9-2hh3	keycloak-services@26.5.4	no fix listed

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.22.0latest	—	—	17125572,407	35,529
0.21.0	—	—	17125572,407	35,529
0.20.0	—	—	17125572,407	35,529

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/cosmo-platform/cosmo.svg)](https://charts.stackradar.io/charts/cosmo-platform/cosmo)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.