Most recent entries from all

ALSA-2026:11389 — Important: vim security update

Affected: AlmaLinux:10: vim-data, AlmaLinux:10: vim-filesystem

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

* vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-05722

BELL-CVE-2026-34982

Affected: Alpaquita:23: vim, Alpaquita:25: vim, Alpaquita:stream: vim

certfr-2026-avi-0406 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoqu…

certfr-2026-avi-0406

EUVD-2026-371756

fkie_cve-2026-34982

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.

msrc_CVE-2026-34982 — Vim modeline bypass via various options affects Vim < 9.2.0276

msrc_CVE-2026-34982

OESA-2026-1922 — vim security update

Affected: openEuler:24.03-LTS-SP3: vim, openEuler:20.03-LTS-SP4: vim, openEuler:22.03-LTS-SP4: vim, openEuler:24.03-LTS: vim, openEuler:24.03-LTS-SP1: vim, openEuler:24.03-LTS-SP2: vim

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor &apos;Vi&apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Security Fix(es):

openSUSE-SU-2026:10652-1 — gvim-9.2.0398-1.1 on GA media

gvim-9.2.0398-1.1 on GA media

RHSA-2026:21275 — Red Hat Security Advisory: Red Hat Update Infrastructure 5.1 security update

python: Quadratic complexity in os.path.expandvars() with user-controlled template cpython: Out-of-memory when loading Plist glib: GLib: Buffer underflow in GVariant parser leads to heap corruption glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow cpython: Header injection via newlines in data URL mediatype in Python firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing cpython: Header injection in http.cookies.Morsel in Python cpython: wsgiref.headers.Headers allows header newline injection in Python python: Python: HTTP header injection via CR/LF in proxy tunnel headers p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters cpython: CPython: Logging Bypass in Legacy .pyc File Handling cpython: Incomplete control character validation in http.cookies cpython: Stack overflow parsing XML with deeply nested DTD content models python: Python: Command-line option injection in webbrowser.open() via crafted URLs python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data openssl: openssl: Information Disclosure f…

SUSE-SU-2026:1347-1 — Security update for vim

Security update for vim

UBUNTU-CVE-2026-34982

Affected: Ubuntu:Pro:20.04:LTS: vim, Ubuntu:22.04:LTS: vim, Ubuntu:24.04:LTS: vim, Ubuntu:25.10: vim

WID-SEC-W-2026-0940 — vim: Schwachstelle ermöglicht Codeausführung

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in vim ausnutzen, um beliebigen Programmcode auszuführen.