VI
Product
vim
260
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 170Medium 71Low 4
Watch
Add vim to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-3778 | 7.8 | Sep 15 | vim is vulnerable to Heap-based Buffer Overflow Affected: before 8.2.3409 |
| CVE-2021-3770 | 7.8 | Sep 6 | vim is vulnerable to Heap-based Buffer Overflow Affected: before 8.2.3408 |
| CVE-2019-20079 | 7.8 | Dec 30 | The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory Affected: 8.1.2121 before 8.1.2136 |
| CVE-2017-11109 | 7.8 | Jul 8 | Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file Affected: 8.0 |
| CVE-2016-1248 | 7.8 | Nov 23 | vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a… Affected: through 8.0.0055 |
| CVE-2026-51401 | 7.7 | Aug 4 | An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c Affected: through 9.2.0389 |
| CVE-2026-26269 | 7.5 | Feb 13 | Vim is an open source, command line text editor Affected: before 9.1.2148 |
| CVE-2023-5344 | 7.5 | Oct 2 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969 Affected: before 9.0.1969 |
| CVE-2022-3705 | 7.5 | Oct 26 | vim autocmd quickfix.c qf_update_buffer use after free Affected: before 9.0.0805 |
| CVE-2022-1620 | 7.5 | May 8 | NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in vim/vim Affected: before 8.2.4901 |
| CVE-2026-73072 | 7.3 | Aug 11 | Vim: Heap Buffer Overflow when Loading a Spell File Affected: < 9.2.0846 |
| CVE-2026-57453 | 7.3 | Jun 25 | Vim: PowerShell Command Injection via Unescaped Filename in zip.vim Extraction Affected: >= 9.1.1784, < 9.2.0678 |
| CVE-2026-33412 | 7.3 | Mar 24 | Vim affected by Command injection via newline in glob() Affected: < 9.2.0202 |
| CVE-2021-3796 | 7.3 | Sep 15 | vim is vulnerable to Use After Free Affected: before 8.2.3428 |
| CVE-2026-35177 | 7.1 | Apr 6 | Path traversal issue with zip.vim in Vim Affected: < 9.2.0280 |
| CVE-2025-27423 | 7.1 | Mar 3 | Vim is an open source, command line text editor Affected: 9.1.0858 before 9.1.1164 |
| CVE-2022-2287 | 7.1 | Jul 2 | Out-of-bounds Read in vim/vim Affected: before 9.0.0021 |
| CVE-2022-0393 | 7.1 | Jan 28 | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2 Affected: before 8.2.4233 |
| CVE-2021-4166 | 7.1 | Dec 25 | Out-of-bounds Read in vim/vim Affected: before 8.2.3884 |
| CVE-2026-46483 | 7.0 | May 15 | Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag Affected: < 9.2.479 |
