cosmo 0.22.0 Helm chart
cosmo-platformOfficialVerified publisherScored 13 Oct 2026
This is the official Helm Chart for WunderGraph Cosmo - The Full Lifecycle GraphQL API Management Solution.
Version 0.22.0App version not verified against the render 2Artifact Hub
cosmo 0.22.0 deploys 10 container images: ghcr.io/wundergraph/cosmo/cdn, ghcr.io/wundergraph/cosmo/controlplane, ghcr.io/wundergraph/cosmo/graphqlmetrics, bitnamilegacy/minio and 6 more. Across them, 2,995 findings — 17 critical, 12 high — 2 on CISA KEV. The highest contribution is BIT-redis-2025-49844 in Redis(R) 7.2.4-5, fixed in 6.2.20.
Radar Score
Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.
Container images
| Image | Tag | Vulnerabilities | Radar Score |
|---|---|---|---|
| ghcr.io/ | 0.14.1 | 0029235 | 2,712 |
| ghcr.io/ | 0.133.1 | 2269285 | 4,335 |
| ghcr.io/ | 0.33.0 | 1041143 | 2,275 |
| bitnamilegacy/ | 2025.7.23-debian-12-r5 | 1084322 | 4,723 |
| ghcr.io/ | 0.18.1 | 22103524 | 7,001 |
| ghcr.io/ | 0.111.0 | 2141209 | 3,052 |
| bitnamilegacy/ | 24.6.2-debian-12-r3 | 1253203 | 3,064 |
| ghcr.io/ | 0.13.0 | 0025117 | 1,615 |
| bitnamilegacy/ | 15.4.0-debian-11-r45 | 4031123 | 2,179 |
| bitnamilegacy/ | 7.2.4-debian-12-r16 | 4581246 | 4,573 |
Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.
Vulnerabilities
| Severity | Advisory | Package | Fixed in |
|---|---|---|---|
| Low | DEBIAN-CVE-2026-72522 | expat | 2.5.0-1+deb12u3 |
| Low | GHSA-4fh9-h7wg-q85m | mdast-util-to-hast | 13.2.1 |
| Low | GHSA-q2hr-2g5m-vwhr | brace-expansion | 2.1.7 |
| Low | DEBIAN-CVE-2026-90804 | binutils | no fix listed |
| Low | GHSA-898c-q2cr-xwhg | axios | 1.16.0 |
| Low | GHSA-27gv-rfvv-22mv | github.com/ | 1.13.0 |
| Low | DEBIAN-CVE-2025-14104 | util-linux | no fix listed |
| Low | GHSA-5pq2-9x2x-5p6w | hono | 4.12.4 |
| Low | GHSA-4jqv-mc3x-m676 | next | 15.5.27 |
| Low | DEBIAN-CVE-2026-56404 | expat | 2.5.0-1+deb12u3 |
| Low | DEBIAN-CVE-2025-69648 | binutils | no fix listed |
| Low | DEBIAN-CVE-2025-69652 | binutils | no fix listed |
| Low | DLA-4492-1 | gnutls28 | 3.7.1-5+deb11u9 |
| Low | DEBIAN-CVE-2023-4641 | shadow | 1:4.13+dfsg1-1+deb12u1 |
| Low | RHSA-2026:12441 | libcap | 0:2.48-10.el9_7.1 |
| Low | DEBIAN-CVE-2026-56410 | expat | 2.5.0-1+deb12u3 |
| Low | DEBIAN-CVE-2026-56411 | expat | 2.5.0-1+deb12u3 |
| Low | DEBIAN-CVE-2024-57360 | binutils | no fix listed |
| Low | DEBIAN-CVE-2024-13176 | openssl | 3.0.16-1~deb12u1 |
| Low | DEBIAN-CVE-2026-56392 | coreutils | no fix listed |
| Low | DEBIAN-CVE-2026-53615 | util-linux | no fix listed |
| Low | GHSA-5p4m-2wfm-xmqj | js-yaml | 4.3.1 |
| Low | GHSA-8h8q-6873-q5fj | next | 15.5.16 |
| Low | GHSA-h25m-26qc-wcjf | next | 15.2.9 |
| Low | GHSA-mwv6-3258-q52c | next | 15.2.7 |
| Low | GHSA-q4gf-8mx6-v5v3 | next | 15.5.15 |
| Low | GHSA-jgwc-jh89-rpgq | keycloak-quarkus-server | no fix listed |
| Low | GHSA-jfc7-64v2-mr8c | @sigstore/ | 3.2.1 |
| Low | GHSA-268h-hp4c-crq3 | nodemailer | 8.0.9 |
| Low | DEBIAN-CVE-2026-56405 | expat | 2.5.0-1+deb12u3 |
| Low | DEBIAN-CVE-2026-56408 | expat | 2.5.0-1+deb12u3 |
| Low | GHSA-wqvq-jvpq-h66f | nodemailer | 8.0.9 |
| Low | DEBIAN-CVE-2025-69651 | binutils | no fix listed |
| Low | GHSA-rv63-4mwf-qqc2 | hono | 4.12.25 |
| Low | GHSA-x7hr-w5r2-h6wg | prismjs | 1.30.0 |
| Low | DEBIAN-CVE-2025-8224 | binutils | no fix listed |
| Low | DEBIAN-CVE-2025-8058 | glibc | 2.36-9+deb12u13 |
| Low | ALPINE-CVE-2026-35189 | openssl | 3.3.7-r2 |
| Low | DEBIAN-CVE-2026-35189 | openssl | no fix listed |
| Low | DEBIAN-CVE-2026-19542 | glibc | no fix listed |
| Low | DEBIAN-CVE-2025-11495 | binutils | no fix listed |
| Low | DEBIAN-CVE-2026-59995 | openssh | no fix listed |
| Low | DEBIAN-CVE-2026-59996 | openssh | no fix listed |
| Low | GHSA-q6h7-xxp7-7429 | keycloak-services | no fix listed |
| Low | DEBIAN-CVE-2026-56391 | coreutils | no fix listed |
| Low | GHSA-r354-f388-2fhh | hono | 4.11.7 |
| Low | DLA-3930-1 | libsepol | 3.1-1+deb11u1 |
| Low | DEBIAN-CVE-2026-4647 | binutils | no fix listed |
| Low | GHSA-444r-cwp2-x5xf | fastify | 5.8.3 |
| Low | GHSA-528h-pc64-c93x | stream-json | 3.5.0 |
Indexed versions
| Version | Published | App version | Vulnerabilities | Radar Score |
|---|---|---|---|---|
| 0.22.0latest | — | — | 17125572,407 | 35,529 |
| 0.21.0 | — | — | 17125572,407 | 35,529 |
| 0.20.0 | — | — | 17125572,407 | 35,529 |
The latest version and the previous major, as selected nightly from the repository’s index.
README badge
Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.