winget packages with open CVEs

2,250 mapped packages currently have at least one open vulnerability. Ranked by critical CVEs published in the last 30 days, then total open CVEs, then install popularity. Updated 6/20/2026, 7:24:25 AM.

Java(TM) SE Development Kit 17
Oracle Corporation · v17.0.12.0
158
open
Java(TM) SE Development Kit 19
Oracle Corporation · v19.0.2.0
158
open
Amazon Corretto 24
Amazon · v24.0.2.12
158
open
Amazon Corretto 23
Amazon · v23.0.2.7
158
open
Java(TM) SE Development Kit 24
Oracle Corporation · v24.0.2.0
158
open
Java(TM) SE Development Kit 21
Oracle Corporation · v21.0.11.0
158
open
Java(TM) SE Development Kit 22
Oracle Corporation · v22.0.2.0
158
open
Amazon Corretto 26
Amazon · v26.0.1.8
158
open
Eclipse Temurin JRE with Hotspot 17
Eclipse Adoptium · v17.0.19.10
153
open
Java 8
Oracle Corporation · v8.0.4910.10
153
open
Amazon Corretto JRE 8
Amazon · v1.8.0.492
153
open
Liberica JRE 21
BellSoft · v21.0.11+11
153
open
Eclipse Temurin JRE with Hotspot 25
Eclipse Adoptium · v25.0.3.9
153
open
Liberica JRE 15
BellSoft · v15.0.2+10
153
open
SapMachine 25 JRE
SapMachine Team · v25.0.3
153
open
SapMachine 11 JRE
SapMachine Team · v11.0.25
153
open
Eclipse Temurin JRE with Hotspot 22
Eclipse Adoptium · v22.0.2.9
153
open
Eclipse Temurin JRE with Hotspot 8
Eclipse Adoptium · v8.0.492.9
153
open
Liberica JRE 16 Full
BellSoft · v16.0.2+7
153
open
Eclipse Temurin JRE with Hotspot 19
Eclipse Adoptium · v19.0.2.7
153
open
Liberica JRE 18 Full
BellSoft · v18.0.2.1+1
153
open
Liberica JRE 11 Full
BellSoft · v11.0.31+11
153
open
Liberica JRE 19 Full
BellSoft · v19.0.2+9
153
open
Liberica JRE 13 Full
BellSoft · v13.0.2+9
153
open