winget packages with open CVEs

2,250 mapped packages currently have at least one open vulnerability. Ranked by critical CVEs published in the last 30 days, then total open CVEs, then install popularity. Updated 5/4/2026, 7:06:59 AM.

Eclipse Temurin JRE with Hotspot 17
Eclipse Adoptium · v17.0.18.8
153
open
Java 8
Oracle Corporation · v8.0.4910.10
153
open
Amazon Corretto JRE 8
Amazon · v1.8.0.492
153
open
FFmpeg (GPL shared variant, 7.1 release branch)
BtbN · v7.1-20250228
136
open
Jellyfin FFmpeg
The Jellyfin Project · v7.1.3-3
136
open
FFmpeg for yt-dlp
yt-dlp · vN-124279-g0f6ba39122-20260430
136
open
FFmpeg for yt-dlp (Shared)
yt-dlp · vN-124279-g0f6ba39122-20260430
136
open
Microsoft SQL Server 2019 Developer
Microsoft · v15.2204.5490.2
133
open
Microsoft System CLR Types for SQL Server 2019
Microsoft Corporation · v15.0.2000.5
133
open
Microsoft SQL Server 2019 Express
Microsoft · v15.2204.5490.2
133
open
IrfanView PlugIns
Irfan Skiljan · v4.73
120
open
qemu-img
cloudbase · v2.3.0
120
open
QEMU
QEMU Community · v11.0.0
120
open
IrfanView
Irfan Skiljan · v4.73
120
open
QEMU guest agent
RedHat · v110.0.2
120
open
Visual Studio Community 2022
Microsoft Corporation · v17.14.31
118
open
Visual Studio BuildTools 2022
Microsoft Corporation · v17.14.31
118
open
Visual Studio 2022 Remote Debugger for Devices
Microsoft Corporation · v17.14.6
118
open
Visual Studio Enterprise 2022
Microsoft Corporation · v17.14.31
118
open
Visual Studio Enterprise 2026 Insiders
Microsoft Corporation · v18.6.11723.189
118
open
Visual Studio Professional 2022
Microsoft Corporation · v17.14.31
118
open
Visual Studio Remote Debugger for Devices
Microsoft Corporation · v18.5.0
118
open
Visual Studio BuildTools 2026
Microsoft Corporation · v18.5.2
118
open
Visual Studio Community 2026 Insiders
Microsoft Corporation · v18.6.11723.189
118
open