winget packages with open CVEs

2,250 mapped packages currently have at least one open vulnerability. Ranked by critical CVEs published in the last 30 days, then total open CVEs, then install popularity. Updated 9/18/2026, 12:16:03 PM.

PHP 8.4
PHP Group · v8.4.25
80
open
PHP 8.1 - Non-thread safe
PHP Group · v8.1.34
80
open
PHP 8.3 - Non-thread safe
PHP Group · v8.3.31
80
open
PHP 8.4 - Non-thread safe
PHP Group · v8.4.22
80
open
PHP 8.5 - Non-thread safe
PHP Group · v8.5.8
80
open
PHP 8.5
PHP Group · v8.5.10
80
open
PHP 8.1
PHP Group · v8.1.34
80
open
PHP 8.2
PHP Group · v8.2.33
80
open
PHP 8.2 - Non-thread safe
PHP Group · v8.2.31
80
open
PHP 8.3
PHP Group · v8.3.33
80
open
PostgreSQL 10
PostgreSQL Global Development Group · v10
78
open
PostgreSQL 17
PostgreSQL Global Development Group · v17.11-3
78
open
PostgreSQL 18
PostgreSQL Global Development Group · v18.6-3
78
open
PostgreSQL 16
PostgreSQL Global Development Group · v16.15-3
78
open
PostgreSQL 12
PostgreSQL Global Development Group · v12.22-1
78
open
psqlodbc
PostgreSQL Global Development Group · v18.00.0002
78
open
PostgreSQL 15
PostgreSQL Global Development Group · v15.19-3
78
open
PostgreSQL 11
PostgreSQL Global Development Group · v11
78
open
PostgreSQL 9
PostgreSQL Global Development Group · v9
78
open
PostgreSQL 14
PostgreSQL Global Development Group · v14.24-2
78
open
psqlodbc (mimalloc version)
PostgreSQL Global Development Group · v18.00.0002
78
open
PostgreSQL 13
PostgreSQL Global Development Group · v13.23-1
78
open
GStreamer
GStreamer Project · v1.28.6
73
open
GstPipelineStudio
dabrain34 · v0.4.0
73
open