winget packages with open CVEs

2,250 mapped packages currently have at least one open vulnerability. Ranked by critical CVEs published in the last 30 days, then total open CVEs, then install popularity. Updated 6/20/2026, 12:41:00 PM.

Eclipse Temurin JRE with Hotspot 19
Eclipse Adoptium · v19.0.2.7
153
open
Liberica JRE 14 Full
BellSoft · v14.0.2+13
153
open
Liberica JRE 13 Full
BellSoft · v13.0.2+9
153
open
Liberica JRE 20
BellSoft · v20.0.2.10
153
open
Eclipse Temurin JRE with Hotspot 20
Eclipse Adoptium · v20.0.2.9
153
open
Liberica JRE 16
BellSoft · v16.0.2+7
153
open
Liberica JRE 19
BellSoft · v19.0.2.9
153
open
Go Programming Language
https://go.dev · v1.26.4
143
open
FFmpeg for yt-dlp (Shared)
yt-dlp · vN-124716-g054dffd133-20260531
136
open
FFmpeg for yt-dlp
yt-dlp · vN-124716-g054dffd133-20260531
136
open
FFmpeg (GPL shared variant, 7.1 release branch)
BtbN · v7.1-20250228
136
open
Jellyfin FFmpeg
The Jellyfin Project · v7.1.4-3
136
open
Microsoft System CLR Types for SQL Server 2019
Microsoft Corporation · v15.0.2000.5
133
open
Microsoft SQL Server 2019 Express
Microsoft · v15.2204.5490.2
133
open
Microsoft SQL Server 2019 Developer
Microsoft · v15.2204.5490.2
133
open
IrfanView
Irfan Skiljan · v4.75
120
open
QEMU
QEMU Community · v11.0.50
120
open
QEMU guest agent
RedHat · v110.0.2
120
open
IrfanView PlugIns
Irfan Skiljan · v4.75
120
open
qemu-img
cloudbase · v2.3.0
120
open
Visual Studio BuildTools 2022
Microsoft Corporation · v17.14.35
118
open
Visual Studio Community 2022
Microsoft Corporation · v17.14.35
118
open
Visual Studio BuildTools 2026
Microsoft Corporation · v18.7.1
118
open
Visual Studio Professional 2022
Microsoft Corporation · v17.14.35
118
open