cosmo 0.22.1 Helm chart

Name: cosmo Helm chart 0.22.1: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

cosmo-platform

Scored 14 Oct 2026

This is the official Helm Chart for WunderGraph Cosmo - The Full Lifecycle GraphQL API Management Solution.

Version 0.22.1App version not verified against the render 2Artifact Hub

cosmo 0.22.1 deploys 10 container images: ghcr.io/wundergraph/cosmo/cdn, ghcr.io/wundergraph/cosmo/controlplane, ghcr.io/wundergraph/cosmo/graphqlmetrics, bitnamilegacy/minio and 6 more. Across them, 2,995 findings — 17 critical, 12 high — 2 on CISA KEV. The highest contribution is BIT-redis-2025-49844 in Redis(R) 7.2.4-5, fixed in 6.2.20.

Radar Score

35,52517125572,407

2,995 findings over 10 of 10 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

10 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/wundergraph/cosmo/cdn	0.14.1	0029235	2,712
ghcr.io/wundergraph/cosmo/controlplane×5	0.133.1	2269285	4,335
ghcr.io/wundergraph/cosmo/graphqlmetrics	0.33.0	1041143	2,275
bitnamilegacy/minio	2025.7.23-debian-12-r5	1084322	4,722
ghcr.io/wundergraph/cosmo/otelcollector	0.18.1	22103524	6,999
ghcr.io/wundergraph/cosmo/studio	0.111.0	2141209	3,050
bitnamilegacy/clickhouse	24.6.2-debian-12-r3	1253203	3,064
ghcr.io/wundergraph/cosmo/keycloak	0.13.0	0025117	1,615
bitnamilegacy/postgresql	15.4.0-debian-11-r45	4031123	2,180
bitnamilegacy/redis×2	7.2.4-debian-12-r16	4581246	4,573

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

1,131 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	GO-2025-3595	golang.org/x/net@v0.33.0	0.38.0
Low	GHSA-7xf9-4jfc-wgm4	keycloak-services@26.5.4	26.5.6
Low	GHSA-68fv-2mgg-jv7q	source-map-js@1.2.1	1.2.2
Low	GHSA-w4pp-8pjf-rmxw	pacote@19.0.1	21.5.1
Low	DSA-5951-1	icu@72.1-3	72.1-3+deb12u1
Low	GHSA-fvcv-3m26-pcqx	axios@1.8.4	1.15.0
Low	GHSA-2mjp-6q6p-2qxm	undici@5.28.4	6.24.0
Low	GHSA-j8rh-479h-cp32	axios@1.8.4	1.20.0
Low	DEBIAN-CVE-2026-5545	curl@7.88.1-10+deb12u12	no fix listed
Low	RHSA-2026:58936	sqlite@3.34.1-9.el9_7	0:3.34.1-11.el9_8
Low	DEBIAN-CVE-2026-58471	wget@1.21.3-1+b2	no fix listed
Low	DEBIAN-CVE-2026-58472	wget@1.21.3-1+b2	no fix listed
Low	DEBIAN-CVE-2026-4437	glibc@2.36-9+deb12u7	2.36-9+deb12u14
Low	GO-2024-2598	stdlib@go1.20.7	1.21.8
Low	DEBIAN-CVE-2026-42015	gnutls28@3.7.9-2+deb12u2	3.7.9-2+deb12u7
Low	DEBIAN-CVE-2026-35387	openssh@1:9.2p1-2+deb12u4	1:9.2p1-2+deb12u10
Low	DEBIAN-CVE-2025-5245	binutils@2.40-2	no fix listed
Low	GHSA-9fr6-4gfg-395g	axios@1.8.4	1.20.0
Low	GHSA-vh66-26gq-q6x8	axios@1.8.4	1.20.0
Low	DEBIAN-CVE-2026-19499	glibc@2.36-9+deb12u7	no fix listed
Low	RHSA-2026:42952	glibc@2.34-231.el9_7.10	0:2.34-274.el9_8
Low	GHSA-574f-3g2m-x479	bcprov-jdk18on@1.82	1.84
Low	GHSA-45gg-vh54-h5m9	golang.org/x/crypto@v0.31.0	0.52.0
Low	DEBIAN-CVE-2025-5244	binutils@2.40-2	no fix listed
Low	GO-2023-2186	stdlib@go1.20.7	1.20.11
Low	DEBIAN-CVE-2025-7545	binutils@2.40-2	no fix listed
Low	DEBIAN-CVE-2018-1000021	git@1:2.39.5-0+deb12u2	no fix listed
Low	GHSA-968p-4wvh-cqc8	@babel/runtime@7.24.5	7.26.10
Low	GHSA-72hv-8253-57qq	jackson-core@2.19.2	2.21.1
Low	GHSA-xxqh-mfjm-7mv9	netty-codec-http@4.1.130.Final	4.1.133.Final
Low	GO-2026-6613	stdlib@go1.21.10	1.26.9
Low	DEBIAN-CVE-2026-76642	util-linux@2.38.1-5+deb12u1	no fix listed
Low	DEBIAN-CVE-2025-70873	sqlite3@3.40.1-2+deb12u1	no fix listed
Low	DEBIAN-CVE-2026-9547	curl@7.88.1-10+deb12u12	no fix listed
Low	DEBIAN-CVE-2025-8941	pam@1.5.2-6+deb12u1	no fix listed
Low	GO-2025-3849	stdlib@go1.21.10	1.23.12
Low	GHSA-c2gf-v879-257j	netty-codec-http2@4.1.130.Final	4.1.135.Final
Low	GHSA-ggv3-7p47-pfv8	next@15.2.4	15.5.13
Low	GHSA-3p68-rc4w-qgx5	axios@1.8.4	1.15.0
Low	GHSA-4c39-4ccg-62r3	next@15.2.4	15.5.21
Low	GHSA-c69g-56f8-xwqj	netty-codec-http2@4.1.130.Final	4.1.136.Final
Low	GO-2026-6605	stdlib@go1.21.10	1.26.9
Low	GHSA-42h9-826w-cgv3	axios@1.8.4	1.18.0
Low	GHSA-pmv8-rq9r-6j72	axios@1.8.4	1.18.0
Low	GHSA-j92g-9f8w-j867	postgresql@42.7.7	42.7.12
Low	DEBIAN-CVE-2021-45346	sqlite3@3.40.1-2+deb12u1	no fix listed
Low	DEBIAN-CVE-2026-35414	openssh@1:9.2p1-2+deb12u4	1:9.2p1-2+deb12u10
Low	DEBIAN-CVE-2026-3784	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15
Low	DSA-6015-1	openssl@3.0.11-1~deb12u2	3.0.17-1~deb12u3
Low	DSA-5931-1	systemd@252.22-1~deb12u1	252.38-1~deb12u1

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.22.1latest	—	—	17125572,407	35,525
0.22.0	—	—	17125572,407	35,525
0.21.0	—	—	17125572,407	35,525
0.20.0	—	—	17125572,407	35,525

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/cosmo-platform/cosmo.svg)](https://charts.stackradar.io/charts/cosmo-platform/cosmo)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.