winget packages with open CVEs

2,250 mapped packages currently have at least one open vulnerability. Ranked by critical CVEs published in the last 30 days, then total open CVEs, then install popularity. Updated 9/18/2026, 6:18:49 AM.

Amazon Corretto 25
Amazon · v25.0.4.8
158
open
Java(TM) SE Development Kit 22
Oracle Corporation · v22.0.2.0
158
open
Java(TM) SE Development Kit 23
Oracle Corporation · v23.0.2.0
158
open
Java(TM) SE Development Kit 19
Oracle Corporation · v19.0.2.0
158
open
Java(TM) SE Development Kit 20
Oracle Corporation · v20.0.2.0
158
open
Amazon Corretto 26
Amazon · v26.0.2.11
158
open
Java(TM) SE Development Kit 24
Oracle Corporation · v24.0.2.0
158
open
Amazon Corretto 24
Amazon · v24.0.2.12
158
open
Open CoreUI
xxnuo · v0.9.6
157
open
Microsoft SQL Server 2022 Express
Microsoft Corporation · v16.0.1000.6
157
open
Open WebUI
Open WebUI Inc. · v0.0.20
157
open
Microsoft SQL Server 2022 Developer
Microsoft Corporation · v16.0.1000.6
157
open
Open CoreUI Desktop
github · v0.9.6
157
open
Eclipse Temurin JRE with Hotspot 25
Eclipse Adoptium · v25.0.4.101
153
open
Eclipse Temurin JRE with Hotspot 8
Eclipse Adoptium · v8.0.504.1
153
open
Eclipse Temurin JRE with Hotspot 17
Eclipse Adoptium · v17.0.20.101
153
open
Java 8
Oracle Corporation · v8.0.5030.1
153
open
Amazon Corretto JRE 8
Amazon · v1.8.0.504
153
open
Liberica JRE 21
BellSoft · v21.0.12.10
153
open
SapMachine 11 JRE
SapMachine Team · v11.0.25
153
open
Liberica JRE 15
BellSoft · v15.0.2+10
153
open
Eclipse Temurin JRE with Hotspot 22
Eclipse Adoptium · v22.0.2.9
153
open
Eclipse Temurin JRE with Hotspot 19
Eclipse Adoptium · v19.0.2.7
153
open
Eclipse Temurin JRE with Hotspot 20
Eclipse Adoptium · v20.0.2.9
153
open