winget packages with open CVEs

2,250 mapped packages currently have at least one open vulnerability. Ranked by critical CVEs published in the last 30 days, then total open CVEs, then install popularity. Updated 5/5/2026, 12:29:47 PM.

Ruby 3.3 with MSYS2
RubyInstaller Team · v3.3.11-1
13
open
Ruby 3.0
RubyInstaller Team · v3.0.7-1
13
open
GNU Emacs
GNU Project · v30.2
13
open
Ruby 3.2 with MSYS2
RubyInstaller Team · v3.2.11-1
13
open
Lua
DEVCOM · v5.4.6
13
open
Citrix Workspace
Citrix Systems, Inc. · v26.3.0.188
13
open
Webex
Cisco Systems, Inc · v46.4.0.34752
13
open
ESET Endpoint Antivirus
ESET, spol. s r.o. · v12.1.2057.3
13
open
Ruby 3.2
RubyInstaller Team · v3.2.11-1
13
open
sentry-cli
Sentry · v3.4.1
13
open
Ruby 3.0 with MSYS2
RubyInstaller Team · v3.0.7-1
13
open
7-Zip ZS
Igor Pavlov, Tino Reichardt, Sergey Brester · v25.01 ZS v1.5.7 R4
13
open
jasper
Ryo Maruyama · v1.1.2
13
open
Citrix Workspace
Citrix Systems, Inc. · v25.7.2000.2020
13
open
Ruby 2.7 with MSYS2
RubyInstaller Team · v2.7.6-1
13
open
Ruby 2.6
RubyInstaller Team · v2.6.10-1
13
open
Lua JLS
SPYL · v0.8.2
13
open
Ruby 4.0 with MSYS2
RubyInstaller Team · v4.0.3-1
13
open
Ruby 2.7
RubyInstaller Team · v2.7.6-1
13
open
Ruby 3.1
RubyInstaller Team · v3.1.7-1
13
open
Smart Switch
Samsung Electronics Co., Ltd. · v4.3.24062.1
13
open
libjxl
libjxl · v0.11.2
13
open
GeoServer
Open Source Geospatial Foundation · v2.28.2
13
open
libvips
libvips · v8.18.2
13
open