winget packages with open CVEs
2,250 mapped packages currently have at least one open vulnerability. Ranked by critical CVEs published in the last 30 days, then total open CVEs, then install popularity. Updated 5/5/2026, 12:29:47 PM.
libvips
libvips · v8.18.2
13
open
Ruby 3.3
RubyInstaller Team · v3.3.11-1
13
open
libjxl
libjxl · v0.11.2
13
open
Ruby 3.1 with MSYS2
RubyInstaller Team · v3.1.7-1
13
open
Ruby 3.0 with MSYS2
RubyInstaller Team · v3.0.7-1
13
open
7-Zip ZS
Igor Pavlov, Tino Reichardt, Sergey Brester · v25.01 ZS v1.5.7 R4
13
open
Notepad++
Notepad++ Team · v8.9.4
12
open
studio-cli
WindRiver · v25.9.0
12
open
FastStone Image Viewer
FastStone Corporation · v8.3
12
open
wgcf
ViRb3 · v2.2.30
12
open
Microsoft Access database engine 2016
Microsoft Corporation · v16.0.5044.1000
12
open
ESET Security
ESET, spol. s r.o. · v18.1.13.0
12
open
Cloudflare WARP
Cloudflare, Inc. · v26.3.851.0
12
open
SyncBreeze Enterprise
Flexense Computing Systems Ltd. · v17.3.16
12
open
SyncBreeze Ultimate
Flexense Computing Systems Ltd. · v17.3.16
12
open
SoX_ng
Sound eXchange NG · v14.7.1.2
12
open
SyncBreeze Pro
Flexense Computing Systems Ltd. · v17.3.16
12
open
SyncBreeze Server
Flexense Computing Systems Ltd. · v17.3.16
12
open
copyparty
ocv.me · v1.20.14
12
open
ESET Security
ESET · v19.1.12.0
12
open
Nextcloud Talk Beta
Nextcloud GmbH · v2.1.2
12
open
jq
jqlang · v1.8.1
12
open
MIT Kerberos for Windows
Massachusetts Institute of Technology · v4.1.0
12
open
LsAgent
Lansweeper · v12.6.3.3
12
open