StackRadar

clowder2 Helm chart

ncsaVerified publisher

Scored 15 Sept 2026

Open Source Data Management for Long Tail Data. Clowder is a customizable and scalable data management framework to support any data format and multiple research domains.

Latest 1.9.7 9 months agoapp version 2.0.0-beta.4 1Artifact Hub

clowder2 1.9.7 deploys 12 container images: bitnamilegacy/minio, bitnamilegacy/mongodb, clowder/clowder2-backend, clowder/clowder2-frontend and 8 more. Across them, 3,295 findings — 14 critical, 33 high — 12 on CISA KEV. The highest contribution is GHSA-f58c-gq56-vjjf in tika-core 2.7.0, fixed in 3.2.2.

Radar Score

37,44114334772,768

3,295 findings over 12 of 12 images measured

KEV ×12 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

12 images
ImageTagVulnerabilitiesRadar Score
bitnamilegacy/minio2023.12.2302261802,291
bitnamilegacy/mongodb5.0.1016312062,886
clowder/clowder2-backend2.0.0-beta.402462423,257
clowder/clowder2-frontend2.0.0-beta.40120741,092
clowder/clowder2-heartbeat2.0.0-beta.402462423,257
clowder/clowder2-messages2.0.0-beta.402462423,257
bitnamilegacy/os-shell×412-debian-12-r1636633074,478
bitnamilegacy/elasticsearch×88.12.2761005337,621
bitnamilegacy/postgresql15.5.020251251,897
library/busybox1.2800000
bitnamilegacy/keycloak20.0.513594525,466
bitnamilegacy/rabbitmq3.10.803151651,939

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

1,208 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

SeverityAdvisoryPackageFixed in
LowPYSEC-2024-232python-jose@3.3.03.4.0
LowDEBIAN-CVE-2026-41991gzip@1.12-1no fix listed
LowGHSA-vjr8-56p3-fmqqkeycloak-quarkus-server@20.0.526.4.4
LowDEBIAN-CVE-2026-5419gnutls28@3.7.9-2+deb12u53.7.9-2+deb12u7
LowGHSA-qmgc-5h2g-mvrwfilelock@3.16.13.20.3
LowDEBIAN-CVE-2026-89157pcre2@10.42-110.42-1+deb12u1
LowDEBIAN-CVE-2026-40226systemd@252.39-1~deb12u1252.39-1~deb12u2
LowGO-2025-3750stdlib@go1.20.131.23.10
LowGO-2026-4864stdlib@go1.20.131.25.9
LowDEBIAN-CVE-2011-4116perl@5.36.0-7+deb12u3no fix listed
LowGO-2025-3447stdlib@go1.20.131.22.12
LowGO-2026-4865stdlib@go1.20.131.25.9
LowGO-2026-4869stdlib@go1.20.131.25.9
LowGHSA-8g9r-9wjw-37j4keycloak-services@20.0.5no fix listed
LowGHSA-5565-3c98-g6jcwildfly-elytron-http-oidc@1.20.1.Final2.2.9.Final
LowGHSA-5565-3c98-g6jcwildfly-elytron@1.20.1.Final2.2.9.Final
LowGO-2026-4340stdlib@go1.20.131.24.12
LowGHSA-gv3v-2cpp-3pmqkeycloak-quarkus-server@20.0.526.5.6
LowGO-2025-4175stdlib@go1.20.131.24.11
LowGHSA-fjf4-6f34-w64qkeycloak-services@20.0.5no fix listed
LowGHSA-fhv5-28vv-h8m8pyjwt@2.6.02.13.0
LowDEBIAN-CVE-2026-89092glibc@2.36-9+deb12u13no fix listed
LowDEBIAN-CVE-2026-18374glibc@2.36-9+deb12u13no fix listed
LowDEBIAN-CVE-2026-25068alsa-lib@1.2.8-1+b1no fix listed
LowDEBIAN-CVE-2026-19542glibc@2.36-9+deb12u13no fix listed
LowGHSA-v9pg-7xvm-68hfpython-multipart@0.0.60.0.31
LowDEBIAN-CVE-2026-16742systemd@252.39-1~deb12u1no fix listed
LowDEBIAN-CVE-2026-54679jq@1.6-2.11.6-2.1+deb12u2
LowGHSA-4q93-v92x-p89fkeycloak-services@20.0.5no fix listed
LowGHSA-4q93-v92x-p89fkeycloak-server-spi-private@20.0.5no fix listed
LowBIT-postgresql-2026-6474postgresql@15.5.0-4214.23.0
LowBIT-postgresql-2026-6474PostgreSQL@15.5.0-4214.23.0
LowGHSA-jgvc-jfgh-rjvvjose4j@0.7.110.9.3
LowALPINE-CVE-2026-34757libpng@1.6.47-r01.6.57-r0
LowDEBIAN-CVE-2026-34757libpng1.6@1.6.39-21.6.39-2+deb12u5
LowGHSA-q4xq-445g-g6chkeycloak-core@20.0.5no fix listed
LowGHSA-993g-76c3-p5m4pyjwt@2.6.02.13.0
LowALPINE-CVE-2025-68160openssl@3.5.4-r03.5.5-r0
LowDEBIAN-CVE-2025-68160openssl@3.0.17-1~deb12u33.0.18-1~deb12u2
LowGHSA-4pgc-gfrr-wcmgkeycloak-services@20.0.5no fix listed
LowGHSA-rhgq-f8x5-j2jckeycloak-services@20.0.526.4.12
LowBIT-postgresql-2026-14678postgresql@15.5.0-4214.24.0
LowBIT-postgresql-2026-14678PostgreSQL@15.5.0-4214.24.0
LowBIT-postgresql-2026-18024PostgreSQL@15.5.0-4214.24.0
LowBIT-postgresql-2026-18024postgresql@15.5.0-4214.24.0
LowBIT-postgresql-2026-6470postgresql@15.5.0-4214.24.0
LowBIT-postgresql-2026-6470PostgreSQL@15.5.0-4214.24.0
LowBIT-java-2026-47059Java@17.0.10-13-21.8.0
LowBIT-java-2026-47059java@17.0.6-10-41.8.0
LowGO-2026-4403stdlib@go1.20.131.23.9

Indexed versions

VersionPublishedApp versionVulnerabilitiesRadar Score
1.9.7latest9 months ago2.0.0-beta.414334772,76837,441

The latest version and the previous major, as selected nightly from the repository’s index.

README badge
[![Radar Score](https://charts.stackradar.io/badge/ncsa/clowder2.svg)](https://charts.stackradar.io/charts/ncsa/clowder2)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.

helm v3.16.4 · syft 1.42.1 · rendered 5 Sept 2026 · scanned 15 Sept 2026 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.