Most recent entries from all

ALSA-2026:6915 — Important: vim security update

Affected: AlmaLinux:8: vim-X11, AlmaLinux:8: vim-common, AlmaLinux:8: vim-enhanced, AlmaLinux:8: vim-filesystem, AlmaLinux:8: vim-minimal

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

* vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417) * vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421) * vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BELL-CVE-2026-33412

Affected: Alpaquita:23: vim, Alpaquita:25: vim, Alpaquita:stream: vim

certfr-2026-avi-0362 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoqu…

certfr-2026-avi-0362

EUVD-2026-362272

fkie_cve-2026-33412

Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.

msrc_CVE-2026-33412 — Vim affected by Command injection via newline in glob()

msrc_CVE-2026-33412

OESA-2026-1781 — vim security update

Affected: openEuler:22.03-LTS-SP4: vim, openEuler:24.03-LTS: vim, openEuler:24.03-LTS-SP1: vim, openEuler:24.03-LTS-SP2: vim, openEuler:24.03-LTS-SP3: vim, openEuler:20.03-LTS-SP4: vim

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor &apos;Vi&apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Security Fix(es):

openSUSE-SU-2026:10652-1 — gvim-9.2.0398-1.1 on GA media

gvim-9.2.0398-1.1 on GA media

RHSA-2026:10065 — Red Hat Security Advisory: Red Hat Update Infrastructure 5.1 security update

libxslt: Processing web content may disclose sensitive information nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing python: Python: Command-line option injection in webbrowser.open() via crafted URLs libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing net/url: Incorrect parsing of IPv6 host literals in net/url vim: Vim: Arbitrary code execution via 'helpfile' option processing nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin vim: Vim: Denial of service and information disclosure via crafted swap file nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files vim: Vim: Arbitrary code execution via command injection in glob() function

SUSE-SU-2026:1347-1 — Security update for vim

Security update for vim

UBUNTU-CVE-2026-33412

Affected: Ubuntu:Pro:14.04:LTS: vim, Ubuntu:Pro:16.04:LTS: vim, Ubuntu:Pro:18.04:LTS: vim, Ubuntu:Pro:20.04:LTS: vim, Ubuntu:22.04:LTS: vim, Ubuntu:24.04:LTS: vim, Ubuntu:25.10: vim

WID-SEC-W-2026-0798 — vim: Schwachstelle ermöglicht Codeausführung

Ein lokaler Angreifer kann eine Schwachstelle in vim ausnutzen, um beliebigen Programmcode auszuführen.