cosmo 0.22.0 Helm chart

Name: cosmo Helm chart 0.22.0: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

cosmo-platform

Scored 13 Oct 2026

This is the official Helm Chart for WunderGraph Cosmo - The Full Lifecycle GraphQL API Management Solution.

Version 0.22.0App version not verified against the render 2Artifact Hub

cosmo 0.22.0 deploys 10 container images: ghcr.io/wundergraph/cosmo/cdn, ghcr.io/wundergraph/cosmo/controlplane, ghcr.io/wundergraph/cosmo/graphqlmetrics, bitnamilegacy/minio and 6 more. Across them, 2,995 findings — 17 critical, 12 high — 2 on CISA KEV. The highest contribution is BIT-redis-2025-49844 in Redis(R) 7.2.4-5, fixed in 6.2.20.

Radar Score

35,52917125572,407

2,995 findings over 10 of 10 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

10 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/wundergraph/cosmo/cdn	0.14.1	0029235	2,712
ghcr.io/wundergraph/cosmo/controlplane×5	0.133.1	2269285	4,335
ghcr.io/wundergraph/cosmo/graphqlmetrics	0.33.0	1041143	2,275
bitnamilegacy/minio	2025.7.23-debian-12-r5	1084322	4,723
ghcr.io/wundergraph/cosmo/otelcollector	0.18.1	22103524	7,001
ghcr.io/wundergraph/cosmo/studio	0.111.0	2141209	3,052
bitnamilegacy/clickhouse	24.6.2-debian-12-r3	1253203	3,064
ghcr.io/wundergraph/cosmo/keycloak	0.13.0	0025117	1,615
bitnamilegacy/postgresql	15.4.0-debian-11-r45	4031123	2,179
bitnamilegacy/redis×2	7.2.4-debian-12-r16	4581246	4,573

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

1,420 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	GHSA-g6gw-c38x-mqfc	hono@4.6.12	4.13.5
Low	GHSA-wjgm-6hv5-3cvf	jackson-databind@2.19.2	2.21.6
Low	GO-2026-4603	stdlib@go1.21.10	1.25.8
Low	DLA-4064-1	libxml2@2.9.10+dfsg-6.7+deb11u4	2.9.10+dfsg-6.7+deb11u6
Low	DEBIAN-CVE-2026-3783	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15
Low	GHSA-563q-j3cm-6jxm	netty-codec-http2@4.1.130.Final	4.1.135.Final
Low	GO-2025-4175	stdlib@go1.21.10	1.24.11
Low	GHSA-qc2q-p7wx-3px3	google.golang.org/grpc@v1.71.0	1.83.1
Low	DSA-5883-1	mercurial@6.3.2-1	6.3.2-1+deb12u1
Low	GHSA-9vqf-7f2p-gf9v	hono@4.6.12	4.12.16
Low	GHSA-qpw4-5x99-6vjp	golang.org/x/crypto@v0.31.0	0.52.0
Low	GHSA-9m57-25v3-79x9	golang.org/x/crypto@v0.31.0	0.52.0
Low	GHSA-3vhc-576x-3qv4	hono@4.6.12	4.11.4
Low	GO-2026-4864	stdlib@go1.21.10	1.25.9
Low	GO-2026-6179	golang.org/x/mod@v0.17.0	0.40.0
Low	DEBIAN-CVE-2024-22365	pam@1.5.2-6+deb12u1	1.5.2-6+deb12u2
Low	DEBIAN-CVE-2026-6429	curl@7.88.1-10+deb12u12	no fix listed
Low	GHSA-v2v4-37r5-5v8g	ip-address@9.0.5	10.1.1
Low	GHSA-f6x5-jh6r-wrfv	golang.org/x/crypto@v0.31.0	0.45.0
Low	DEBIAN-CVE-2025-15367	python3.11@3.11.2-6+deb12u5	no fix listed
Low	GHSA-6wqw-2p9w-4vw4	hono@4.6.12	4.11.7
Low	GO-2026-4865	stdlib@go1.21.10	1.25.9
Low	GO-2026-4982	stdlib@go1.21.10	1.25.10
Low	GO-2026-5025	golang.org/x/net@v0.33.0	0.55.0
Low	GHSA-3v7f-55p6-f55p	picomatch@2.3.1	2.3.2
Low	GHSA-5x3r-wrvg-rp6q	netty-codec-http2@4.1.130.Final	4.1.135.Final
Low	GHSA-gvwx-54wh-qm9j	tar@7.4.3	7.5.17
Low	DEBIAN-CVE-2026-86143	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed
Low	GHSA-h3mg-xc3c-68pw	ip-address@9.0.5	10.7.1
Low	DEBIAN-CVE-2026-86140	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed
Low	DEBIAN-CVE-2026-86142	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed
Low	GHSA-3rh2-v3gr-35p9	github.com/minio/minio@v0.0.0-20250723155402-7ced9663e6a7	no fix listed
Low	DEBIAN-CVE-2025-10148	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15
Low	GHSA-w62v-xxxg-mg59	hono@4.6.12	4.12.27
Low	GHSA-83g3-92jg-28cx	tar@7.4.3	7.5.8
Low	DEBIAN-CVE-2026-78410	util-linux@2.38.1-5+deb12u1	no fix listed
Low	DEBIAN-CVE-2026-4873	curl@7.88.1-10+deb12u12	no fix listed
Low	DEBIAN-CVE-2026-89160	pcre2@10.42-1	10.42-1+deb12u1
Low	DEBIAN-CVE-2026-77117	glibc@2.36-9+deb12u7	no fix listed
Low	DEBIAN-CVE-2026-80489	glibc@2.36-9+deb12u7	no fix listed
Low	RHSA-2026:79281	glibc@2.34-231.el9_7.10	0:2.34-283.el9_8
Low	GHSA-68g3-v927-f742	next@15.2.4	15.5.21
Low	DEBIAN-CVE-2024-26462	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u3
Low	DEBIAN-CVE-2026-1965	curl@7.88.1-10+deb12u12	no fix listed
Low	DLA-4437-1	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3
Low	GHSA-cp6g-7hqx-qxhp	go.mongodb.org/mongo-driver@v1.17.3	1.17.7
Low	DEBIAN-CVE-2022-0563	util-linux@2.38.1-5+deb12u1	no fix listed
Low	DEBIAN-CVE-2026-102633	expat@2.5.0-1+deb12u1	no fix listed
Low	GHSA-5c9x-8gcm-mpgx	axios@1.8.4	1.15.1
Low	GHSA-vf2m-468p-8v99	axios@1.8.4	1.15.1

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.22.0latest	—	—	17125572,407	35,529
0.21.0	—	—	17125572,407	35,529
0.20.0	—	—	17125572,407	35,529

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/cosmo-platform/cosmo.svg)](https://charts.stackradar.io/charts/cosmo-platform/cosmo)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.