Most recent entries from all

bdu:2026-06512

BELL-CVE-2026-44656

Affected: Alpaquita:23: vim, Alpaquita:25: vim, Alpaquita:stream: vim

certfr-2026-avi-0588 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un at…

certfr-2026-avi-0588

EUVD-2026-309886

fkie_cve-2026-44656

Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find completion. This issue has been patched in version 9.2.0435.

msrc_CVE-2026-44656 — Vim: OS Command Injection via 'path' completion

msrc_CVE-2026-44656

OESA-2026-2447 — vim security update

Affected: openEuler:22.03-LTS-SP4: vim

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor &apos;Vi&apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Security Fix(es):

Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.(CVE-2026-42307)

Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loadi…

openSUSE-SU-2026:11114-1 — gvim-9.2.0530-1.1 on GA media

gvim-9.2.0530-1.1 on GA media

RHSA-2026:57614 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

vim: arbitrary command execution via modeline sandbox bypass vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass vim: Vim: Arbitrary code execution via command injection in NetBeans interface vim: Command injection allows arbitrary code execution via malicious tag files vim: Vimscript injection via unescaped filename in netrw s:NetrwMarkFile() filter() expression allows arbitrary code execution vim: Vim: Arbitrary command execution via :find command-line completion vim: Vim: Heap buffer overflow allows arbitrary code execution or denial of service vim: command injection when decompressing .tgz archives vim: Vim: Arbitrary Code Execution via crafted directory names vim: Vim: Arbitrary code execution via crafted step-definition patterns vim: Vim: Arbitrary code execution via Python omni-completion vim: Vim: Denial of Service via out-of-bounds write in terminal handling vim: Vim: Arbitrary code execution through Python omni-completion. vim: Vim: Denial of service via crafted undo file vim: Vim: Arbitrary code execution via crafted zip archive entry names vim: Vim: Out-of-bounds Read with Text Properties vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion

SUSE-SU-2026:21833-1 — Security update for vim

Security update for vim

UBUNTU-CVE-2026-44656

Affected: Ubuntu:Pro:14.04:LTS: vim, Ubuntu:Pro:16.04:LTS: vim, Ubuntu:Pro:18.04:LTS: vim, Ubuntu:Pro:20.04:LTS: vim, Ubuntu:22.04:LTS: vim, Ubuntu:24.04:LTS: vim, Ubuntu:25.10: vim, Ubuntu:26.04:LTS: vim

WID-SEC-W-2026-1335 — vim: Schwachstelle ermöglicht Codeausführung

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in vim ausnutzen, um beliebigen Programmcode auszuführen.