CVE-2026-73077

A vulnerability in Vim's shell script plugins sh.vim, zsh.vim, ps1.vim allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters. Mitigation To mitigate this vulnerability, users can...

Vim < 9.2.0839 OS Command Injection (GHSA-r5v6-q6j8-8qw2)

The version of Vim installed on the remote host is prior to 9.2.0839. It is, therefore, affected by a vulnerability as referenced in the GHSA-r5v6-q6j8-8qw2 advisory. - The runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled...

Linux Distros Unpatched Vulnerability : CVE-2026-73077

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype...

CVE-2026-73077

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments...

EUVD-2026-56233

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments...

CLSA-2026-1777558504 vim: Fix of 10 CVEs

CVE-2021-3928: in suggesttriewalk only credit a non-word-char boundary with SCORENONWORD when preword is non-empty, so spell suggestions do not read uninitialized memory behind preword. - CVE-2021-3974: in nfaregmatch NFAMARK / NFAMARKGT / NFAMARKLT, save reginput - regline and re-fetch regline...

CLSA-2026-1777545655 vim: Fix of 10 CVEs

CVE-2021-3928: in suggesttriewalk only credit a non-word-char boundary with SCORENONWORD when preword is non-empty, so spell suggestions do not read uninitialized memory behind preword. - CVE-2021-3974: in nfaregmatch NFAMARK / NFAMARKGT / NFAMARKLT, save reginput - regline and re-fetch regline...

Important: vim

Issue Overview: When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctl...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2026-1584)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1584 advisory. When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore ma...

Unity Linux 20.1070e Security Update: vim (UTSA-2026-006151)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006151 advisory. When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end...

CLSA-2026-1767712744 vim: Fix of 2 CVEs

CVE-2025-22134: correctly reset the visual mode before opening other windows and buffers - CVE-2025-24014: skip the redraw attempt that accesses an unallocated variable...

CLSA-2025-1765286037 Fix CVE(s): CVE-2025-22134

SECURITY UPDATE: Heap-buffer overflow when switching buffers in visual mode - debian/patches/CVE-2025-22134.patch: fix visual mode heap-buffer-overflow by resetting VIsual mode on :all - CVE-2025-22134...

CLSA-2025-1761576318 Fix CVE(s): CVE-2022-3520

SECURITY UPDATE: Heap-based Buffer Overflow in visual mode - debian/patches/CVE-2022-3520.patch: check that the column does not become negative - CVE-2022-3520...

EUVD-2021-28942

Malicious code in bioql PyPI...

EUVD-2025-2654

Malicious code in bioql PyPI...

CVE-2021-41947

A SQL injection vulnerability exists in Subrion CMS v4.2.1 in the visual-mode...

EulerOS 2.0 SP10 : vim (EulerOS-SA-2025-1542)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does no...

EulerOS 2.0 SP12 : vim (EulerOS-SA-2025-1441)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does no...

EulerOS 2.0 SP11 : vim (EulerOS-SA-2025-1380)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does no...

Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2025-1380)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...