Most recent entries from all

ALSA-2026:28209 — Moderate: vim security update

Affected: AlmaLinux:9: vim-X11, AlmaLinux:9: vim-common, AlmaLinux:9: vim-enhanced, AlmaLinux:9: vim-filesystem, AlmaLinux:9: vim-minimal

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

* vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-09836

BELL-CVE-2026-41411

Affected: Alpaquita:23: vim, Alpaquita:25: vim, Alpaquita:stream: vim

certfr-2026-avi-0513 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoqu…

certfr-2026-avi-0513

EUVD-2026-293275

fkie_cve-2026-41411

Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.

msrc_CVE-2026-41411 — Vim: Command injection via backtick expansion in tag filenames

msrc_CVE-2026-41411

OESA-2026-2201 — vim security update

Affected: openEuler:24.03-LTS-SP3: vim

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor &apos;Vi&apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Security Fix(es):

RHSA-2026:28049 — Red Hat Security Advisory: vim security update

vim: arbitrary command execution via modeline sandbox bypass vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass vim: Command injection allows arbitrary code execution via malicious tag files vim: command injection when decompressing .tgz archives

RHSA-2026:28050 — Red Hat Security Advisory: vim security update

RLSA-2026:28209 — Moderate: vim security update

Affected: Rocky Linux:9: vim

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

* vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-41411

Affected: Ubuntu:Pro:14.04:LTS: vim, Ubuntu:Pro:16.04:LTS: vim, Ubuntu:Pro:18.04:LTS: vim, Ubuntu:Pro:20.04:LTS: vim, Ubuntu:22.04:LTS: vim, Ubuntu:24.04:LTS: vim, Ubuntu:25.10: vim, Ubuntu:26.04:LTS: vim

WID-SEC-W-2026-1147 — vim: Schwachstelle ermöglicht Codeausführung

Ein Angreifer kann eine Schwachstelle in vim ausnutzen, um beliebigen Programmcode auszuführen.