Methodology

The index covers the 300 most-starred Helm charts on Artifact Hub, read from its public catalogue feed once a day. Ties in stars are broken by whether the repository is official, then whether its publisher is verified, then by name. Only charts served from an http(s) Helm repository are selectable, because the pipeline reads each repository’s index.yaml for the chart’s versions and tarball; a chart published only to an OCI registry is passed over. A chart whose newest version is marked deprecated, or that has no release version, is passed over too.

Two versions of each chart are indexed: the newest release, and the newest release of the previous major when the chart has one. A chart that drops out of the top set keeps its pages, marked as no longer selected, and is left out of the lists and the sitemap.

Nothing about StackRadar’s users enters the selection. This site has its own database and never reads the product’s; the only signal is public popularity.

Each version is rendered with helm template over its tarball, with the chart’s default values and nothing else. The render passes a --kube-version taken from the kubeVersion range the chart declares: the middle minor of a bounded range, the minimum of an unbounded one, and helm’s own default when the chart declares none. Most of the index was rendered with helm v3.16.4; each chart page states the version used for that chart.

Every PodSpec in the rendered manifests is walked — Deployments, StatefulSets, DaemonSets, Jobs, CronJobs, ReplicaSets and bare Pods — and every image in its init, regular and ephemeral containers is recorded, in document order. Hook resources (helm.sh/hook) are included, because they run at install and their images are real, and their rows are marked as hooks. Test hooks (helm.sh/hook: test) are excluded, because they never run in normal operation.

What a default-values render does not see is counted as unmeasured, never guessed at: optional subcharts the default values leave disabled, images set through an operator’s flags or inside a CRD payload, and images the chart pulls from a registry outside the allow-list below. Each chart page lists its unmeasured images with the reason. A tarball above the size cap, a render that exceeds its time or output cap, or a download that fails is recorded as a failed render with the reason, and the version shows no score.

Each image reference is resolved from its tag to a digest against the registry’s own API — the manifest-list digest, the same identity a kubelet records when it pulls by tag. A reference already pinned to a digest is used as is. Only these public registries are contacted: Docker Hub (docker.io), Quay.io (quay.io), GitHub Container Registry (ghcr.io), Google Container Registry (gcr.io), Kubernetes registry (registry.k8s.io), Amazon ECR Public (public.ecr.aws), Microsoft Container Registry (mcr.microsoft.com), GitLab Container Registry (registry.gitlab.com). A reference to any other registry stays unmeasured with that reason.

Each digest is inventoried once, for one platform (linux/amd64), with syft — most of the index with syft 1.42.1 — producing a CycloneDX document that is validated against the CycloneDX schema before its components are stored. The same digest reached through two tags, or by two charts, is one image with one inventory and one score. Pulls from Docker Hub use an account when one is configured, so that Hub’s rate limits apply to the account rather than to the site’s address; every other registry is read anonymously.

The components of every inventoried image are matched daily against StackRadar’s mirror of OSV, joined with exploitation probabilities from FIRST EPSS and the CISA Known Exploited Vulnerabilities catalogue. The matcher is the product’s, called as a function; it stores nothing about this index. Today’s numbers come from OSV data as of 2 Sept 2026, EPSS scores dated 29 Aug 2026 and KEV catalogue 2026.09.01; the same dates appear in the footer of every page.

A finding is counted once per package and advisory: the binary packages built from one deb, rpm or apk source package share their advisories and are counted under the source package, and a distribution notice (a USN, DSA or RHSA) that cross-references a CVE on the same component is folded into that CVE’s finding rather than counted beside it. Only exact and fuzzy version matches count; withdrawn advisories do not.

Every finding carries a contribution from 0 to 100 that is a function of the public advisory alone: its severity for consequence, its EPSS probability and KEV listing for likelihood, combined in the open — not a multiplication of CVSS by EPSS by KEV. The function is documented at stackradar.io/docs/radar-score and is computed by the product; this site reads the result.

A chart version’s Radar Score is the sum of the contributions of every finding over its distinct measured images; an image mounted twice counts once. An image’s score is the same sum over its own findings. The number is not capped: it says how much is there. The colour is the band of the worst single finding, never a threshold on the total; it says how bad the worst thing is. The bands, on a finding’s contribution: critical at 70 or more, high at 40 or more, medium at 15 or more, low at 1 or more; a finding below 1 has no band. How many replicas run, how old the image is, whether it is an init container — exposure is deliberately not in the number.

Every chart version with at least one measured image gets one sample a day: its score, band, counts and the number of images measured. A version with nothing measured gets no sample, so a gap in the history means “not measured”, never “clean”. Each finding on an image records the day it was first seen there and the day it was last seen, so a page can say since when a finding has been present.

The upgrade delta on a chart page compares the previous major’s newest release with the latest: the two renders’ images are paired by repository, each measured pair’s current findings are diffed, and the resolved, introduced and unchanged findings are summed over the pairs. Images on one side only are listed as added or removed. A chart whose two versions are not both measured shows no delta.

A score can move without the chart changing, because the advisory data behind every finding is refreshed daily. Each daily sample therefore stores the four inputs it depended on: the date of the OSV mirror, the EPSS score date, the KEV catalogue version, and the image set from the chart’s last render. When a sample differs from the day before, the chart page lists which of the four changed between the two. A move with none of them changed is a correction in the advisory mirror — a record amended on the server side — and is labelled as such.

A score is never re-derived from old data. The history is a record of what was known on each day, not a restatement of today’s knowledge across the past.

Matching and scoring run once a day, after the advisory mirror’s daily EPSS and KEV syncs. The selection, rendering and inventory run nightly before that; the latest version of every chart is re-rendered weekly so a moving tag is re-resolved. Pages are cached for an hour and the lists for five minutes, so a new day’s numbers are on every page within an hour of the run.

If the last successful scoring run is more than 36 hours old, a banner above the header on every page says so, with the date. After 7 days the pages also ask search engines not to index them until the pipeline recovers. Both switch off on the next successful run.

Last successful select

2 Sept 2026, 19:24 UTC

Last successful render

2 Sept 2026, 19:28 UTC

Last successful inventory

never

Last successful match

2 Sept 2026, 19:33 UTC

Last successful score

2 Sept 2026, 19:33 UTC

Versions waiting to be rendered

211

Images waiting for an inventory

190

Failed renders in the last 7 days

11

Index

300 charts · 49 images · scored 2 Sept 2026

The catalogue — which charts exist, their stars, versions and repositories — is read from Artifact Hub through the bulk endpoint its FAQ offers to consumers of the whole catalogue, once a day; every chart page links to the chart’s Artifact Hub page. Artifact Hub is a CNCF project and is named here descriptively; it is not affiliated with this site. The chart versions and tarballs come from each chart’s own Helm repository.

Vulnerability records come from OSV, which asks for attribution and gets it: every finding links to its record on osv.dev. Exploitation probabilities are FIRST’s EPSS daily scores; the exploited-in-the-wild flag is CISA’s Known Exploited Vulnerabilities catalogue. Images are pulled from the registries listed above within each registry’s published terms and limits, and from no other host.

Write to contact@stackradar.io. Include the page’s address, the chart or image and version, the finding’s identifier where one is involved, what you believe is wrong, and the source that shows it. Every number is checked against the sources named above; a mistake in the pipeline is fixed there and the correction lands on the next daily run, which the history records as a move. Earlier samples are not rewritten: they stand as what was known on their day.

Not your cluster. The index shows what a chart deploys with its default values; the containers in a real cluster carry the values, versions and images that were actually chosen there. The free StackRadar CLI answers the same question for the cluster in front of you, with no account.

Not a ranking of maintainers. There is no “worst” list; scores are sums over public advisories at a point in time, and the most-improved list exists so that a fix shows.