winget packages with open CVEs
2,250 mapped packages currently have at least one open vulnerability. Ranked by critical CVEs published in the last 30 days, then total open CVEs, then install popularity. Updated 9/19/2026, 6:16:52 AM.
Ruby 3.1 with MSYS2
RubyInstaller Team · v3.1.7-1
14
open
Ruby 2.7 with MSYS2
RubyInstaller Team · v2.7.6-1
14
open
Ruby 3.3
RubyInstaller Team · v3.3.12-1
14
open
Ruby 3.2 with MSYS2
RubyInstaller Team · v3.2.11-1
14
open
Ruby 2.6
RubyInstaller Team · v2.6.10-1
14
open
Harbor CLI
Harbor · v0.0.26
14
open
Docker Desktop
Docker Inc. · v4.91.0
13
open
Citrix Workspace
Citrix Systems, Inc. · v26.3.11.10
13
open
Citrix Workspace
Citrix Systems, Inc. · v26.7.0.269
13
open
Webex
Cisco Systems, Inc · v46.9.0.35800
13
open
Lua
DEVCOM · v5.4.6
13
open
Docker Desktop Edge
Docker Inc. · v2.5.4.50534
13
open
NanaZip
Kenji Mouri · v7.0.1832.0
13
open
GNU Emacs
GNU Project · v31.1
13
open
Smart Switch
Samsung Electronics Co., Ltd. · v4.3.24062.1
13
open
NanaZip Preview
Kenji Mouri · v7.0.1800.0
13
open
libjxl
libjxl · v0.12.0
13
open
GoAnywhere OpenPGP Studio
Fortra · v1.2.3
13
open
ESET Endpoint Antivirus
ESET, spol. s r.o. · v13.0.2044.0
13
open
Velociraptor
Velocidex · v0.65.3
13
open
libvips
libvips · v8.18.6
13
open
Lua JLS
SPYL · v0.8.2
13
open
jasper
Ryo Maruyama · v1.1.2
13
open
Cloudflare One Client
Cloudflare, Inc. · v26.7.1376.0
12
open