Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2022-1619 | 7.8 high | 3.0% | vim, fedoraproject, fedora, debian_linux | Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution | 8 Oct |
| CVE-2022-1616 | 7.8 high | 3.0% | vim, fedoraproject, fedora, debian_linux | Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution | 8 Oct |
| CVE-2018-20786 | 7.5 high | 3.0% | leonerd, libvterm | libvterm through 0+bzr726, as used in Vim and other products, mishandles certain out-of-memory conditions, leading to a denial of service (application crash), related to screen.c, state.c, and vterm.c. | 15 Oct |
| CVE-2021-3968 | 8.0 high | 2.0% | vim, fedoraproject, fedora | vim is vulnerable to Heap-based Buffer Overflow | 8 Oct |
| CVE-2021-4136 | 7.8 high | 2.0% | vim, fedoraproject, fedora, mac_os_x | vim is vulnerable to Heap-based Buffer Overflow | 8 Oct |
| CVE-2021-3973 | 7.8 high | 2.0% | vim, fedoraproject, fedora, debian_linux | vim is vulnerable to Heap-based Buffer Overflow | 8 Oct |
| CVE-2022-2183 | 7.8 high | 2.0% | vim, fedoraproject, fedora | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2022-2182 | 7.8 high | 2.0% | vim, fedoraproject, fedora | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2022-2126 | 7.8 high | 2.0% | vim, debian, debian_linux, fedora | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2022-2125 | 7.8 high | 2.0% | vim, fedoraproject, fedora, macos | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2022-2124 | 7.8 high | 2.0% | vim, debian, debian_linux, fedora | Buffer Over-read in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2021-3927 | 7.8 high | 2.0% | vim, fedoraproject, fedora, debian_linux | vim is vulnerable to Heap-based Buffer Overflow | 8 Oct |
| CVE-2022-1620 | 7.5 high | 2.0% | vim, fedoraproject, fedora, macos | NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input. | 8 Oct |
| CVE-2021-4166 | 7.1 high | 2.0% | vim, redhat, enterprise_linux, factory | vim is vulnerable to Out-of-bounds Read | 8 Oct |
| CVE-2022-1674 | 5.5 medium | 2.0% | vim, fedoraproject, fedora, macos | NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input. | 8 Oct |
| CVE-2022-2946 | 7.8 high | 1.0% | vim, fedoraproject, fedora, debian_linux | Use After Free in GitHub repository vim/vim prior to 9.0.0246. | 9 Oct |
| CVE-2022-2845 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218. | 9 Oct |
| CVE-2022-2304 | 7.8 high | 1.0% | vim, fedoraproject, fedora, debian_linux | Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. | 8 Oct |
| CVE-2022-2257 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. | 8 Oct |
| CVE-2022-2042 | 7.8 high | 1.0% | vim, apple, macos | Use After Free in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2021-3928 | 7.8 high | 1.0% | vim, fedoraproject, fedora, debian_linux | vim is vulnerable to Use of Uninitialized Variable | 8 Oct |
| CVE-2022-2522 | 7.8 high | 1.0% | vim | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061. | 8 Oct |
| CVE-2022-2345 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Use After Free in GitHub repository vim/vim prior to 9.0.0046. | 8 Oct |
| CVE-2022-2344 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045. | 8 Oct |
| CVE-2022-2343 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044. | 8 Oct |
| CVE-2022-2286 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. | 8 Oct |
| CVE-2022-2285 | 7.8 high | 1.0% | vim, fedoraproject, fedora, debian_linux | Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0. | 8 Oct |
| CVE-2022-2284 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. | 8 Oct |
| CVE-2022-2210 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2022-2207 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2022-2206 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2022-2175 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Buffer Over-read in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2022-2129 | 7.8 high | 1.0% | vim, fedoraproject, fedora, debian_linux | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2022-0351 | 7.8 high | 1.0% | vim, debian, debian_linux, macos | Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2021-3974 | 7.8 high | 1.0% | vim, fedoraproject, fedora, debian_linux | vim is vulnerable to Use After Free | 8 Oct |
| CVE-2023-20900 | 7.5 high | 1.0% | vmware, fedoraproject, tools, open_vm_tools, fedora | A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . | 8 Oct |
| CVE-2022-2287 | 7.1 high | 1.0% | vim, fedoraproject, fedora | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. | 8 Oct |
| CVE-2022-0213 | 6.6 medium | 1.0% | vim, debian, debian_linux | vim is vulnerable to Heap-based Buffer Overflow | 8 Oct |
| CVE-2026-112944 | 6.3 medium | 1.0% | no CPE yet | launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2. | 20 Oct |
| CVE-2022-2208 | 5.5 medium | 1.0% | vim, fedoraproject, fedora | NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163. | 8 Oct |
| CVE-2026-51400 | 8.4 high | 0.00% | vim | An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c | Sat 24 Oct |
| CVE-2026-34982 | 8.2 high | 0.00% | vim | Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue. | Sat 24 Oct |
| CVE-2025-66476 | 7.8 high | 0.00% | vim | Vim is an open source, command line text editor. Prior to version 9.1.1947, an uncontrolled search path vulnerability on Windows allows Vim to execute malicious executables placed in the current working directory for the current edited file. On Windows, when using cmd.exe as a shell, Vim resolves external commands by searching the current working directory before system paths. When Vim invokes tools such as findstr for :grep, external commands or filters via :!, or compiler/:make commands, it may inadvertently run a malicious executable present in the same directory as the file being edited. The issue affects Vim for Windows prior to version 9.1.1947. | 18 Oct |
| CVE-2026-43961 | 7.8 high | 0.00% | no CPE yet | A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim. | 16 Oct |
| CVE-2022-2849 | 7.8 high | 0.00% | vim, fedoraproject, fedora | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220. | 9 Oct |
| CVE-2026-51401 | 7.7 high | 0.00% | vim | An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c | Sat 24 Oct |
| CVE-2026-73073 | 7.1 high | 0.00% | vim | Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845. | 15 Oct |
| CVE-2026-86022 | 7.0 high | 0.00% | no CPE yet | VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the quoted path and add arguments to the victim's configured external program. If the configured program supports an argument that executes commands, such as the vim or gvim -c option, the injected arguments can execute arbitrary commands as the user. This issue is fixed in version 4.3.0. | 16 Oct |
48 of 48
Download these 48 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.