winget packages with open CVEs

2,250 mapped packages currently have at least one open vulnerability. Ranked by critical CVEs published in the last 30 days, then total open CVEs, then install popularity. Updated 9/18/2026, 12:16:03 PM.

SapMachine 25 JDK
SapMachine Team · v25.0.4.256
86
open
Eclipse Temurin JDK with Hotspot 22
Eclipse Adoptium · v22.0.2.9
86
open
SapMachine 21 JDK
SapMachine Team · v21.0.12.1
86
open
Eclipse Temurin JDK with Hotspot 26
Eclipse Adoptium · v26.0.2.101
86
open
AdoptOpenJDK JDK with Eclipse OpenJ9 17
AdoptOpenJDK · v17.0.0.18
86
open
ojdkbuild OpenJDK JRE 17
ojdkbuild open-source project · v17.0030.6.1
86
open
Eclipse Temurin JDK with Hotspot 18
Eclipse Adoptium · v18.0.2.101
86
open
Liberica JDK 25
BellSoft · v25.0.4.101
86
open
SapMachine 23 JDK
SapMachine Team · v23.0.2
86
open
SapMachine 21 JRE
SapMachine Team · v21.0.12.1
86
open
Microsoft Build of OpenJDK with Hotspot 16
Microsoft · v16.0.2.7
86
open
Liberica JDK 15 Lite
BellSoft · v15.0.2+10
86
open
Liberica JDK 22 Lite
BellSoft · v22.0.2.11
86
open
AdoptOpenJDK JDK with Hotspot 11
AdoptOpenJDK · v11.0.11.9
86
open
Liberica JDK 21 Lite
BellSoft · v21.0.12.10
86
open
Liberica JDK 21 Full
BellSoft · v21.0.12.101
86
open
SapMachine 22 JDK
SapMachine Team · v22.0.2
86
open
SapMachine 17 JRE
SapMachine Team · v17.0.20.1
86
open
SapMachine 24 JDK
SapMachine Team · v24.0.2
86
open
SapMachine 22 JRE
SapMachine Team · v22.0.2
86
open
Liberica JDK 18 Lite
BellSoft · v18.0.2.1+1
86
open
OpenJDK JRE 11
ojdkbuild open-source project · v11.0.15.1
86
open
AdoptOpenJDK JDK with Hotspot 16
AdoptOpenJDK · v16.0.1.9
86
open
ojdkbuild OpenJDK 17
ojdkbuild open-source project · v17.0030.6.1
86
open