winget packages with open CVEs

2,250 mapped packages currently have at least one open vulnerability. Ranked by critical CVEs published in the last 30 days, then total open CVEs, then install popularity. Updated 9/19/2026, 6:16:52 AM.

calibre
Kovid Goyal · v9.15.0
15
open
Sandboxie
sandboxie-plus.com · v5.73.4
15
open
UltraVNC
uvnc bvba · v1.8.3.0
15
open
calibre portable
calibre-ebook.com · v8.12.0.0
15
open
Jira Service Management Long Term Support
Atlassian · v11.3.10
15
open
Xibo Player
Xibo Signage Ltd · v4.407.2
15
open
sentry-cli
Sentry · v3.7.0
15
open
HP Support Assistant
HP Inc. · v9.47.41.0
14
open
Ruby 3.4 with MSYS2
RubyInstaller Team · v3.4.10-1
14
open
Harbor
harbor · v0.5.11
14
open
Sped Fiscal ICMS IPI
Receita Federal do Brasil · v6.1.1
14
open
Ruby 4.0 with MSYS2
RubyInstaller Team · v4.0.6-1
14
open
IObit Malware Fighter
IObit · v13.5.0.1684
14
open
TheiaIDE
Eclipse Theia · v1.75.0
14
open
Ruby 2.7
RubyInstaller Team · v2.7.6-1
14
open
Ruby 4.0
RubyInstaller Team · v4.0.7-1
14
open
Ruby 3.3 with MSYS2
RubyInstaller Team · v3.3.12-1
14
open
TheiaBlueprint
Eclipse Theia · v1.44.0
14
open
Ruby 3.0
RubyInstaller Team · v3.0.7-1
14
open
Ruby 3.0 with MSYS2
RubyInstaller Team · v3.0.7-1
14
open
Ruby 3.4
RubyInstaller Team · v3.4.10-1
14
open
Ruby 3.2
RubyInstaller Team · v3.2.11-1
14
open
Ruby 3.1
RubyInstaller Team · v3.1.7-1
14
open
Ruby 3.1 with MSYS2
RubyInstaller Team · v3.1.7-1
14
open