Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
354 results · page 1 of 8
Oct 27, 2026All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos: Stored Cross-Site ScriptingCVE-2026-109974 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more_link' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
- Affected
- up to 4.9.7
- What to do
- Affects up to 4.9.7. Update All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 27, 2026All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos: Stored Cross-Site ScriptingCVE-2026-109209 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_fields[embedcode]' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is possible because the save_meta_data() handler returns early when $_POST['post_type'] is absent — a condition always true during XML-RPC requests — and the plugin unconditionally grants Subscribers the publish_aiovg_videos capability, making this exploitable by any authenticated user via a single wp.newPost XML-RPC call.
- Product
- All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
- Affected
- up to 4.9.7
- What to do
- Affects up to 4.9.7. Update All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 19, 2026A flaw was found in Vim's netrw plugin.CVE-2026-43961 · Other software · vim · reported by Red HatHigh 7.8
A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 18, 2026Vim is an open source, command line text editor.CVE-2026-73073 · Other software · vim · reported by GitHubHigh 7.1
Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Vim is an open source, command line text editor.CVE-2026-73078 · Other software · vim · reported by GitHubHigh 8.6
Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Vim is an open source, command line text editor.CVE-2026-73077 · Other software · vim · reported by GitHubHigh 8.4
Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Vim is an open source, command line text editor.CVE-2026-73076 · Other software · vim · reported by GitHubHigh 8.4
Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Vim is an open source, command line text editor.CVE-2026-73075 · Other software · vim · reported by GitHubMedium 4.6
Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Vim is an open source, command line text editor.CVE-2026-73074 · Other software · vim · reported by GitHubHigh 7.1
Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Vim is an open source, command line text editor.CVE-2026-73072 · Other software · vim · reported by GitHubHigh 8.5
Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Vim is an open source, command line text editor.CVE-2026-73071 · Other software · vim · reported by GitHubLow 3.3
Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Vim is an open source, command line text editor.CVE-2026-73070 · Other software · vim · reported by GitHubMedium 6.8
Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserver_accept(), causing descriptors to overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c, which allows a local process that can connect to the server socket to corrupt stack memory or terminate the Vim server. This issue is fixed in version 9.2.0842.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.CVE-2026-65543 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 4, 2026An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.cCVE-2026-51401 · Other software · VIM · reported by MITREHigh 7.7
An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c
- Product
- VIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 4, 2026An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.cCVE-2026-51400 · Other software · VIM · reported by MITREHigh 8.4
An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c
- Product
- VIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick …: Authentication BypassCVE-2026-18072 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the `_arve_uc_init()` function — registered on WordPress's `init` hook at priority 1 so that it runs before any authentication checks on every request — reads an attacker-supplied token from the `_wplogin` (or `_wpm`) parameter and compares it against a hardcoded SHA-256 hash embedded directly in the plugin source, with no nonce verification, no capability check, and no password validation anywhere in the flow. Because this static hash constitutes a set of universal credentials that are publicly accessible in the plugin's source code, unauthenticated attackers can supply the known token to be authenticated as an arbitrarily selected existing administrator account, gaining full administrative control over the affected WordPress site. This was likely introduced by an attacker who gained commit access to the developers account.
- Product
- Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick …
- What to do
- Update Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 17, 2026Missing Authorization vulnerability in Vimesoft Inc.CVE-2026-12694 · Other software · Vimesoft Inc. · reported by iletisim@usom.gov.trCritical 9.1
Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.
- Product
- Enterprise Video Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc.CVE-2026-12693 · Other software · Vimesoft Inc. · reported by iletisim@usom.gov.trCritical 9.4
Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.
- Product
- Enterprise Video Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Unverified password change vulnerability in Vimesoft Inc.CVE-2026-12692 · Other software · Vimesoft Inc. · reported by iletisim@usom.gov.trCritical 9.8
Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.
- Product
- Enterprise Video Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Missing authentication for critical function vulnerability in Vimesoft Inc.CVE-2026-12691 · Other software · Vimesoft Inc. · reported by iletisim@usom.gov.trHigh 7.5
Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.
- Product
- Enterprise Video Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Vim is an open source, command line text editor.CVE-2026-59858 · Other software · vim · reported by GitHubHigh 8.4
Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Vim is an open source, command line text editor.CVE-2026-59857 · Other software · vim · reported by GitHubMedium 5.6
Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Vim is an open source, command line text editor.CVE-2026-59856 · Other software · vim · reported by GitHubHigh 8.4
Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Vim is an open source, command line text editor.CVE-2026-57456 · Other software · vim · reported by GitHubHigh 8.4
Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope's docstring is inserted verbatim between triple quotes with no escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled Python during omni-completion. This vulnerability is fixed in 9.2.0699.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Vim is an open source, command line text editor.CVE-2026-57455 · Other software · vim · reported by GitHubMedium 4
Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0698.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Vim is an open source, command line text editor.CVE-2026-57454 · Other software · vim · reported by GitHubMedium 6.8
Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a virtual-text property whose offset and length point outside the line's property data. When Vim restores or displays such a line it converts the offset into a pointer and reads the virtual text without bounds checking, causing an out-of-bounds read that can crash Vim or disclose adjacent heap memory. This vulnerability is fixed in 9.2.0679.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Vim is an open source, command line text editor.CVE-2026-57453 · Other software · vim · reported by GitHubMedium 6.5
Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to browse, read, extract, update or delete entries in a zip archive, it builds the PowerShell command by inserting archive entry names that are quoted only for the shell, not for PowerShell. A crafted entry name can break out of the intended string context and cause PowerShell to execute arbitrary commands with the privileges of the user running Vim, triggered by opening, viewing or extracting the archive. This vulnerability is fixed in 9.2.0678.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Vim is an open source, command line text editor.CVE-2026-57452 · Other software · vim · reported by GitHubMedium 5.5
Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Vim is an open source, command line text editor.CVE-2026-57451 · Other software · vim · reported by GitHubMedium 5.3
Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Vim is an open source, command line text editor.CVE-2026-55895 · Other software · vim · reported by GitHubMedium 5.7
Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!. This vulnerability is fixed in 9.2.0663.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Vim is an open source, command line text editor.CVE-2026-55892 · Other software · vim · reported by GitHubMedium 5.5
Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Vim is an open source, command line text editor.CVE-2026-55693 · Other software · vim · reported by GitHubMedium 5.7
Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Vim is an open source, command line text editor.CVE-2026-52860 · Other software · vim · reported by GitHubHigh 7.5
Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluates function default values, parameter annotations, and class base expressions at definition time, so a hostile buffer can execute attacker-controlled Python expressions during omni-completion. The existing g:pythoncomplete_allow_import mitigation (GHSA-52mc-rq6p-rc7c) does not cover this path, because the attacker-controlled code is not a harvested import/from statement. This issue has been patched in version 9.2.0597.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Vim is an open source, command line text editor.CVE-2026-52859 · Other software · vim · reported by GitHubMedium 6.9
Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars[] array with no upper bound, stopping only when it encounters a NUL terminator. When a cell legitimately fills all VTERM_MAX_CHARS_PER_CELL (6) slots — a base character plus five combining marks — the bundled libvterm returns the array without a terminating NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in version 9.2.0565.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Vim is an open source, command line text editor.CVE-2026-52858 · Other software · vim · reported by GitHubHigh 7.3
Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Vim is an open source, command line text editor.CVE-2026-47167 · Other software · vim · reported by GitHubMedium 5.1
Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository's features/*/ or stories/*/ directories are embedded into a Ruby Kernel.eval argument without sufficient escaping, allowing a crafted pattern in an attacker-controlled repository to execute arbitrary Ruby (and through it arbitrary shell commands) when the user invokes a step-jump mapping ([d, ]d). This issue has been patched in version 9.2.0496.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Vim is an open source, command line text editor.CVE-2026-47162 · Other software · vim · reported by GitHubHigh 7.3
Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2026A flaw has been found in Neovim up to 0.12.2.CVE-2026-11487 · Other software · reported by VulDBLow 1.9
A flaw has been found in Neovim up to 0.12.2. Affected by this issue is the function M.read of the file runtime/lua/vim/secure.lua of the component View Branch. Executing a manipulation of the argument path can lead to command injection. It is possible to launch the attack on the local host. The exploit has been published and may be used. This patch is called f83e0dcaf8cf18de94828341b0a1a61a86c75baf. A patch should be applied to remediate this issue.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2026Vim is an open source, command line text editor.CVE-2026-46483 · Other software · vim · reported by GitHubLow 3.6
Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Vim is an open source, command line text editor.CVE-2026-45130 · Other software · vim · reported by GitHubMedium 6.6
Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Vim is an open source, command line text editor.CVE-2026-44656 · Other software · vim · reported by GitHubMedium 4.6
Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find completion. This issue has been patched in version 9.2.0435.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Vim is an open source, command line text editor.CVE-2026-42307 · Other software · vim · reported by GitHubMedium 4.4
Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2026Vim is an open source, command line text editor.CVE-2026-41411 · Other software · vim · reported by GitHubMedium 6.6
Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Vim is an open source, command line text editor.CVE-2026-39881 · Other software · vim · reported by GitHubMedium 5
Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Vim is an open source, command line text editor.CVE-2026-35177 · Other software · vim · reported by GitHubMedium 4.1
Vim is an open source, command line text editor. Prior to 9.2.0280, a path traversal bypass in Vim's zip.vim plugin allows overwriting of arbitrary files when opening specially crafted zip archives, circumventing the previous fix for CVE-2025-53906. This vulnerability is fixed in 9.2.0280.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Vim is an open source, command line text editor.CVE-2026-34982 · Other software · vim · reported by GitHubHigh 8.2
Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs wiCVE-2026-34714 · Other software · Vim · reported by MITRECritical 9.2
Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.
- Product
- Vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vim is an open source, command line text editor.CVE-2026-33412 · Other software · vim · reported by GitHubMedium 5.6
Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026Vim is an open source, command line text editor.CVE-2026-32249 · Other software · vim · reported by GitHubMedium 5.3
Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Vim is an open source, command line text editor.CVE-2026-28422 · Other software · vim · reported by GitHubLow 2.2
Vim is an open source, command line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in `build_stl_str_hl()` when rendering a statusline with a multi-byte fill character on a very wide terminal. Version 9.2.0078 patches the issue.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.