winget packages with open CVEs

2,250 mapped packages currently have at least one open vulnerability. Ranked by critical CVEs published in the last 30 days, then total open CVEs, then install popularity. Updated 5/4/2026, 6:36:27 PM.

GrafanaOSS
Grafana Labs · v13.0.1
75
open
Node.js 6
Node.js Foundation · v6.17.0
75
open
Node.js 4
Node.js Foundation · v4.8.7
75
open
Node.js (LTS)
Node.js Foundation · v24.15.0
75
open
Node.js
Node.js Foundation · v25.9.0
75
open
Node.js 18
Node.js Foundation · v18.20.8
75
open
Node.js 22
Node.js Foundation · v22.22.2
75
open
Node.js 12
Node.js Foundation · v12.22.12
75
open
Node.js 14
Node.js Foundation · v14.21.3
75
open
Node.js 19
Node.js Foundation · v19.9.0
75
open
Node.js 17
Node.js Foundation · v17.9.1
75
open
Node.js 7
Node.js Foundation · v7.1.0
75
open
cURL
curl · v8.19.0.8
73
open
Mattermost
Mattermost, Inc. · v6.0.4
72
open
Visual Studio Enterprise 2017
Microsoft Corporation · v15.9.70
71
open
Ghost Trap
PaperCut Software Int. Pty. Ltd. · v1.6.10.04
71
open
Hashicorp Vault
HashiCorp, Inc. · v2.0.0
71
open
Apache Lounge httpd
Apache Lounge · v2.4.66
71
open
Zoom Workplace
Zoom · v7.0.34412
70
open
GstPipelineStudio
dabrain34 · v0.4.0
70
open
Zoom Workplace (EXE)
Zoom Video Communications, Inc. · v7.0.2 (34412)
70
open
GStreamer
GStreamer Project · v1.28.2
70
open
Jira Software Long Term Support
Atlassian · v11.3.1
69
open
NVIDIA DisplayPort Firmware Updater
NVIDIA Corporation · v1.1
68
open