winget packages with open CVEs

2,250 mapped packages currently have at least one open vulnerability. Ranked by critical CVEs published in the last 30 days, then total open CVEs, then install popularity. Updated 9/18/2026, 6:18:49 AM.

SapMachine 25 JRE
SapMachine Team · v25.0.4.256
153
open
Liberica JRE 11 Full
BellSoft · v11.0.32.11
153
open
Liberica JRE 13 Full
BellSoft · v13.0.2+9
153
open
Liberica JRE 19 Full
BellSoft · v19.0.2+9
153
open
Liberica JRE 20
BellSoft · v20.0.2.10
153
open
Liberica JRE 16
BellSoft · v16.0.2+7
153
open
Liberica JRE 20 Full
BellSoft · v20.0.2+10
153
open
Liberica JRE 18 Full
BellSoft · v18.0.2.1+1
153
open
Liberica JRE 16 Full
BellSoft · v16.0.2+7
153
open
Liberica JRE 19
BellSoft · v19.0.2.9
153
open
Liberica JRE 18
BellSoft · v18.0.2.1+1
153
open
Liberica JRE 14 Full
BellSoft · v14.0.2+13
153
open
Go Programming Language
https://go.dev · v1.27.0
145
open
FFmpeg for yt-dlp
yt-dlp · vN-125875-g5d4d3bdc61-20260731
142
open
FFmpeg for yt-dlp (Shared)
yt-dlp · vN-125875-g5d4d3bdc61-20260731
142
open
FFmpeg (GPL shared variant, 7.1 release branch)
BtbN · v7.1-20250228
142
open
Jellyfin FFmpeg
The Jellyfin Project · v8.1.2-4
142
open
Visual Studio BuildTools 2026
Microsoft Corporation · v18.10.1
136
open
Visual Studio BuildTools 2022
Microsoft Corporation · v17.14.41
136
open
Visual Studio Community 2026
Microsoft Corporation · v18.10.1
136
open
Visual Studio Community 2022
Microsoft Corporation · v17.14.41
136
open
Visual Studio Professional 2026
Microsoft Corporation · v18.10.1
136
open
Visual Studio Enterprise 2026
Microsoft Corporation · v18.10.1
136
open
Visual Studio Professional 2022
Microsoft Corporation · v17.14.41
136
open