StackRadar

clowder2 Helm chart

ncsaVerified publisher

Scored 15 Sept 2026

Open Source Data Management for Long Tail Data. Clowder is a customizable and scalable data management framework to support any data format and multiple research domains.

Latest 1.9.7 9 months agoapp version 2.0.0-beta.4 1Artifact Hub

clowder2 1.9.7 deploys 12 container images: bitnamilegacy/minio, bitnamilegacy/mongodb, clowder/clowder2-backend, clowder/clowder2-frontend and 8 more. Across them, 3,295 findings — 14 critical, 33 high — 12 on CISA KEV. The highest contribution is GHSA-f58c-gq56-vjjf in tika-core 2.7.0, fixed in 3.2.2.

Radar Score

37,44114334772,768

3,295 findings over 12 of 12 images measured

KEV ×12 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

12 images
ImageTagVulnerabilitiesRadar Score
bitnamilegacy/minio2023.12.2302261802,291
bitnamilegacy/mongodb5.0.1016312062,886
clowder/clowder2-backend2.0.0-beta.402462423,257
clowder/clowder2-frontend2.0.0-beta.40120741,092
clowder/clowder2-heartbeat2.0.0-beta.402462423,257
clowder/clowder2-messages2.0.0-beta.402462423,257
bitnamilegacy/os-shell×412-debian-12-r1636633074,478
bitnamilegacy/elasticsearch×88.12.2761005337,621
bitnamilegacy/postgresql15.5.020251251,897
library/busybox1.2800000
bitnamilegacy/keycloak20.0.513594525,466
bitnamilegacy/rabbitmq3.10.803151651,939

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

1,208 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

SeverityAdvisoryPackageFixed in
LowALPINE-CVE-2025-15469openssl@3.5.4-r03.5.5-r0
LowGO-2026-5970golang.org/x/text@v0.14.00.39.0
LowPYSEC-2026-2275requests@2.28.22.33.0
LowBIT-mongodb-2025-3082mongodb@5.0.10-05.0.31
LowGHSA-f5h4-wmp5-xhg6keycloak-server-spi-private@20.0.521.1.2
LowGHSA-f5h4-wmp5-xhg6keycloak-services@20.0.521.1.2
LowDEBIAN-CVE-2026-56391coreutils@9.1-1no fix listed
LowGHSA-933f-rg6j-f46pkeycloak-services@20.0.526.4.12
LowALPINE-CVE-2026-42768openssl@3.5.4-r03.5.7-r0
LowDLA-4306-1pam@1.4.0-9+deb11u11.4.0-9+deb11u2
LowGO-2025-4155stdlib@go1.20.131.24.11
LowBIT-keycloak-2026-16089keycloak@20.0.5-626.7.3
LowDEBIAN-CVE-2025-14017curl@7.88.1-10+deb12u5no fix listed
LowGO-2024-2888stdlib@go1.20.131.21.11
LowALPINE-CVE-2026-32778expat@2.7.3-r02.7.5-r0
LowBIT-java-2023-22006java@17.0.6-10-411.0.20
LowGHSA-rg35-5v25-mqvpkeycloak-services@20.0.526.0.0
LowGO-2025-4008stdlib@go1.20.131.24.8
LowGO-2025-4010stdlib@go1.20.131.24.8
LowPYSEC-2025-185python-jose@3.3.0no fix listed
LowPYSEC-2026-248starlette@0.26.11.3.0
LowGHSA-q6h7-xxp7-7429keycloak-services@20.0.5no fix listed
LowDEBIAN-CVE-2024-10041pam@1.5.2-6+deb12u1no fix listed
LowGO-2023-1840stdlib@go1.18.21.19.10
LowDLA-4130-1shadow@1:4.8.1-11:4.8.1-1+deb11u1
LowALPINE-CVE-2026-32776expat@2.7.3-r02.7.5-r0
LowDLA-4217-1icu@67.1-767.1-7+deb11u1
LowDEBIAN-CVE-2025-0167curl@7.88.1-10+deb12u57.88.1-10+deb12u11
LowDEBIAN-CVE-2026-40612jq@1.6-2.1no fix listed
LowDEBIAN-CVE-2026-44777jq@1.6-2.11.6-2.1+deb12u2
LowDSA-6076-1libpng1.6@1.6.39-21.6.39-2+deb12u1
LowDEBIAN-CVE-2026-50812sqlite3@3.40.1-2+deb12u2no fix listed
LowGO-2025-4014stdlib@go1.20.131.24.8
LowBIT-postgresql-2026-14663PostgreSQL@15.5.0-4214.24.0
LowBIT-postgresql-2026-14663postgresql@15.5.0-4214.24.0
LowDEBIAN-CVE-2026-41256jq@1.6-2.11.6-2.1+deb12u2
LowDEBIAN-CVE-2026-43894jq@1.6-2.11.6-2.1+deb12u2
LowALPINE-CVE-2026-6042musl@1.2.5-r101.2.5-r11
LowGO-2025-3503stdlib@go1.20.131.23.7
LowDEBIAN-CVE-2026-43896jq@1.6-2.11.6-2.1+deb12u2
LowDEBIAN-CVE-2026-18938p11-kit@0.24.1-2no fix listed
LowGHSA-q35r-vvhv-vx5hkeycloak-server-spi-private@20.0.526.5.6
LowGHSA-q35r-vvhv-vx5hkeycloak-services@20.0.526.5.6
LowGHSA-q35r-vvhv-vx5hkeycloak-model-jpa@20.0.526.5.6
LowGO-2026-6107go.etcd.io/etcd/client/pkg/v3@v3.5.113.5.33
LowBIT-postgresql-2026-6472PostgreSQL@15.5.0-4214.23.0
LowBIT-postgresql-2026-6472postgresql@15.5.0-4214.23.0
LowDEBIAN-CVE-2026-13595util-linux@2.38.1-5+deb12u3no fix listed
LowGO-2026-4976stdlib@go1.20.131.25.10
LowBIT-java-2026-21925Java@17.0.10-13-21.8.0

Indexed versions

VersionPublishedApp versionVulnerabilitiesRadar Score
1.9.7latest9 months ago2.0.0-beta.414334772,76837,441

The latest version and the previous major, as selected nightly from the repository’s index.

README badge
[![Radar Score](https://charts.stackradar.io/badge/ncsa/clowder2.svg)](https://charts.stackradar.io/charts/ncsa/clowder2)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.

helm v3.16.4 · syft 1.42.1 · rendered 5 Sept 2026 · scanned 15 Sept 2026 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.