Most recent entries from all

ALSA-2026:38509 — Important: vim security update

Affected: AlmaLinux:10: vim-X11, AlmaLinux:10: vim-common, AlmaLinux:10: vim-data, AlmaLinux:10: vim-enhanced, AlmaLinux:10: vim-filesystem, AlmaLinux:10: vim-minimal, AlmaLinux:10: xxd

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

* vim: command injection when decompressing .tgz archives (CVE-2026-46483) * vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162) * vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858) * vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-10802

certfr-2026-avi-0753 — De multiples vulnérabilités ont été découvertes dans Microsoft Azure. Elles permettent à un attaquant de provoquer un p…

certfr-2026-avi-0753

EUVD-2026-371790

fkie_cve-2026-47162

Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.

msrc_CVE-2026-47162 — Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name

msrc_CVE-2026-47162

OESA-2026-2761 — vim security update

Affected: openEuler:22.03-LTS-SP4: vim

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor &apos;Vi&apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Security Fix(es):

Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository's features/*/ or stories/*/ directories are embedded into a Ruby Kernel.eval argument without sufficient escaping, allowing a crafted pattern in an attacker-controll…

RHSA-2026:38509 — Red Hat Security Advisory: vim security update

vim: command injection when decompressing .tgz archives vim: Vim: Arbitrary Code Execution via crafted directory names vim: Vim: Arbitrary code execution via crafted step-definition patterns vim: Vim: Arbitrary code execution via Python omni-completion

RHSA-2026:53371 — Red Hat Security Advisory: Insights proxy Container Image

httpd: incomplete fix for CVE-2023-38709 libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling glibc: glibc: Out-of-bounds write via TSIG record processing glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings glibc: glibc: Application crash or uninitialized memory read via crafted DNS response DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution. p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders Apache HTTP Server: mod_rewrite: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation httpd: NULL pointer dereference via specially crafted request httpd: mod_auth_digest: timing attack allows a bypass of digest authentication httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc httpd: Apache HTTP S…

RLSA-2026:38509 — Important: vim security update

Affected: Rocky Linux:10: vim

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

* vim: command injection when decompressing .tgz archives (CVE-2026-46483)

* vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162)

* vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858)

* vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-47162

Affected: Ubuntu:Pro:14.04:LTS: vim, Ubuntu:Pro:16.04:LTS: vim, Ubuntu:Pro:18.04:LTS: vim, Ubuntu:Pro:20.04:LTS: vim, Ubuntu:22.04:LTS: vim, Ubuntu:24.04:LTS: vim, Ubuntu:25.10: vim, Ubuntu:26.04:LTS: vim

WID-SEC-W-2026-1570 — vim: Mehrere Schwachstellen ermöglichen Codeausführung

Ein Angreifer kann mehrere Schwachstellen in vim ausnutzen, um beliebigen Programmcode auszuführen.