artifact-hub Helm chart

Name: artifact-hub Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

softonic

Scored 14 Sept 2026

Artifact Hub is a web-based application that enables finding, installing, and publishing Cloud Native packages.

Latest 1.19.0 1 year agoapp version 1.19.0 1Artifact Hub

artifact-hub 1.19.0 deploys 8 container images: artifacthub/postgres, bitnami/kubectl, artifacthub/hub, aquasec/trivy and 4 more. Across the 7 measured, 1,381 findings — 2 critical, 23 high — 2 on CISA KEV. The highest contribution is ALPINE-CVE-2023-38545 in curl 8.1.2-r0, fixed in 8.4.0-r0. Chart.yaml declares kubeVersion >= 1.19.0-0; rendered for Kubernetes 1.19.0.

Radar Score

14,4912231841,172

1,381 findings over 7 of 8 images measured

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

8 images

Image	Tag	Vulnerabilities	Radar Score
artifacthub/postgres×5	latest	0142222	2,676
bitnami/kubectl	1.19	—	unmeasured
artifacthub/hub	v1.19.0	0324201	2,209
aquasec/trivy	0.43.1	21050220	3,575
bitnami/minideb	stretch	0001	7
artifacthub/db-migrator	v1.19.0	032696	1,428
artifacthub/scanner	v1.19.0	0427211	2,429
artifacthub/tracker	v1.19.0	0215221	2,167

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

480 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	GO-2023-2375	stdlib@go1.19.10	1.20.0
Low	GHSA-vvgc-356p-c3xw	golang.org/x/net@v0.26.0	0.38.0
Low	GHSA-rq77-p4h8-4crw	github.com/gorilla/csrf@v1.7.2	1.7.3
Low	GHSA-qc2q-p7wx-3px3	google.golang.org/grpc@v1.64.0	1.83.1
Low	GHSA-c77r-fh37-x2px	github.com/open-policy-agent/opa@v0.65.0	0.68.0
Low	GO-2023-2382	stdlib@go1.19.10	1.20.12
Low	GHSA-qpw4-5x99-6vjp	golang.org/x/crypto@v0.24.0	0.52.0
Low	ALPINE-CVE-2026-22796	openssl@3.3.1-r0	3.3.6-r0
Low	DEBIAN-CVE-2026-22796	openssl@3.5.1-1	3.5.4-1~deb13u2
Low	GHSA-f6x5-jh6r-wrfv	golang.org/x/crypto@v0.24.0	0.45.0
Low	GHSA-78mq-xcr3-xm33	golang.org/x/crypto@v0.24.0	0.52.0
Low	GO-2024-2599	stdlib@go1.19.10	1.21.8
Low	GHSA-rmx9-2pp3-xhcr	github.com/tektoncd/pipeline@v0.60.2	1.0.2
Low	GHSA-fcv2-xgw5-pqxf	github.com/sigstore/sigstore@v1.8.3	1.10.4
Low	GO-2024-3106	stdlib@go1.22.4	1.22.7
Low	ALPINE-CVE-2024-2004	curl@8.1.2-r0	8.7.1-r0
Low	ALPINE-CVE-2023-42364	busybox@1.36.1-r0	1.36.1-r7
Low	ALPINE-CVE-2023-42363	busybox@1.36.1-r0	1.36.1-r7
Low	DEBIAN-CVE-2022-0563	util-linux@2.41-5	no fix listed
Low	DLA-4061-1	libtasn1-6@4.16.0-2+deb11u1	4.16.0-2+deb11u2
Low	DEBIAN-CVE-2026-4878	libcap2@1:2.75-10+b1	1:2.75-10+deb13u1
Low	DEBIAN-CVE-2026-11979	libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u1	no fix listed
Low	DEBIAN-CVE-2026-86140	libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u1	no fix listed
Low	GO-2024-2600	stdlib@go1.19.10	1.21.8
Low	ALPINE-CVE-2023-42366	busybox@1.36.1-r0	1.36.1-r6
Low	GHSA-hrxh-6v49-42gf	google.golang.org/grpc@v1.64.0	1.82.1
Low	GO-2024-2609	stdlib@go1.19.10	1.21.8
Low	DEBIAN-CVE-2026-34743	xz-utils@5.8.1-1	5.8.1-1+deb13u1
Low	GO-2024-3107	stdlib@go1.22.4	1.22.7
Low	DEBIAN-CVE-2026-5704	tar@1.35+dfsg-3.1	no fix listed
Low	ALPINE-CVE-2023-42365	busybox@1.36.1-r0	1.36.1-r7
Low	DEBIAN-CVE-2026-3184	util-linux@2.41-5	no fix listed
Low	GHSA-cp6g-7hqx-qxhp	go.mongodb.org/mongo-driver@v1.14.0	1.17.7
Low	GHSA-xmrv-pmrh-hhx2	github.com/aws/aws-sdk-go-v2/service/s3@v1.54.2	1.97.3
Low	GHSA-xmrv-pmrh-hhx2	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.1	1.7.8
Low	GHSA-xmrv-pmrh-hhx2	github.com/aws/aws-sdk-go-v2/service/kinesis@v1.24.6	1.43.5
Low	GHSA-xmrv-pmrh-hhx2	github.com/aws/aws-sdk-go-v2/service/lambda@v1.49.6	1.88.5
Low	GHSA-xmrv-pmrh-hhx2	github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.30.1	1.65.0
Low	GHSA-95pr-fxf5-86gv	github.com/sigstore/cosign@v1.13.6	no fix listed
Low	ALPINE-CVE-2024-6874	curl@8.1.2-r0	8.9.0-r0
Low	DEBIAN-CVE-2026-7010	perl@5.40.1-6	5.40.1-6+deb13u1
Low	DEBIAN-CVE-2026-19487	perl@5.40.1-6	no fix listed
Low	ALPINE-CVE-2023-52426	expat@2.5.0-r1	2.6.0-r0
Low	GHSA-9m57-25v3-79x9	golang.org/x/crypto@v0.24.0	0.52.0
Low	GHSA-jc7w-c686-c4v9	github.com/ulikunitz/xz@v0.5.11	0.5.15
Low	GHSA-pwhc-rpq9-4c8w	github.com/containerd/containerd@v1.7.17	1.7.29
Low	GHSA-273p-m2cw-6833	github.com/sigstore/rekor@v1.3.6	1.5.0
Low	DEBIAN-CVE-2026-89158	pcre2@10.46-1~deb13u1	10.46-1~deb13u2
Low	GHSA-x86f-5xw2-fm2r	github.com/docker/docker@v26.1.3+incompatible	no fix listed
Low	GO-2023-2041	stdlib@go1.19.10	1.20.8

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
1.19.0latest	1 year ago	1.19.0	2231841,172	14,491

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/softonic/artifact-hub.svg)](https://charts.stackradar.io/charts/softonic/artifact-hub)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.