winget packages with open CVEs

2,250 mapped packages currently have at least one open vulnerability. Ranked by critical CVEs published in the last 30 days, then total open CVEs, then install popularity. Updated 6/20/2026, 6:33:41 PM.

Node.js 21
Node.js Foundation · v21.7.3
75
open
Node.js 23
Node.js Foundation · v23.11.0
75
open
Node.js 7
Node.js Foundation · v7.1.0
75
open
Node.js 4
Node.js Foundation · v4.8.7
75
open
Node.js 15
Node.js Foundation · v15.14.0
75
open
Node.js 18
Node.js Foundation · v18.20.8
75
open
Node.js 12
Node.js Foundation · v12.22.12
75
open
Node.js 19
Node.js Foundation · v19.9.0
75
open
Node.js 6
Node.js Foundation · v6.17.0
75
open
Node.js 16
Node.js Foundation · v16.20.2
75
open
Mattermost
Mattermost, Inc. · v6.0.4
72
open
Hashicorp Vault
HashiCorp, Inc. · v2.0.3
71
open
Visual Studio Enterprise 2017
Microsoft Corporation · v15.9.70
71
open
Ghost Trap
PaperCut Software Int. Pty. Ltd. · v1.6.10.04
71
open
GStreamer
GStreamer Project · v1.28.4
70
open
Zoom Workplace
Zoom · v7.0.38856
70
open
Zoom Workplace (EXE)
Zoom Video Communications, Inc. · v7.0.5 (38856)
70
open
GstPipelineStudio
dabrain34 · v0.4.0
70
open
Jira Software Long Term Support
Atlassian · v11.3.1
69
open
NVIDIA DisplayPort Firmware Updater
NVIDIA Corporation · v1.1
69
open
NVIDIA DisplayID Firmware Updater
NVIDIA Corporation · v1.1.0
69
open
QNAP Qsync Client
QNAP Systems, Inc. · v6.0.2.0529
62
open
UniversalForwarder
Splunk, Inc. · v10.4.0
59
open
Liberica NIK Core 23 (JDK 21)
BellSoft · v23.1.4
58
open