{"id":"CVE-2026-39881","aliases":["ALPINE-CVE-2026-39881","AZL-82010","BELL-CVE-2026-39881","CLSA-2026-1777567716","CLSA-2026-1777568566","CLSA-2026-1777625424","CLSA-2026-1777889241","CLSA-2026-1777942049","CLSA-2026-1777943581","CLSA-2026-1778020398","CLSA-2026-1778021665","CLSA-2026-1779356802","CLSA-2026-1787304699","DEBIAN-CVE-2026-39881","EUVD-2026-20622","GHSA-mr87-rhgv-7pw6","MGASA-2026-0123","OESA-2026-2003","OESA-2026-2004","OESA-2026-2005","OESA-2026-2006","OESA-2026-2007","RHSA-2026:57614","ROOT-OS-DEBIAN-11-CVE-2026-39881","ROOT-OS-DEBIAN-12-CVE-2026-39881","SUSE-SU-2026:1764-1","SUSE-SU-2026:2029-1","SUSE-SU-2026:21414-1","SUSE-SU-2026:21450-1","SUSE-SU-2026:21833-1","SUSE-SU-2026:21840-1","SUSE-SU-2026:21859-1","SUSE-SU-2026:2313-1","UBUNTU-CVE-2026-39881","openSUSE-SU-2026:10652-1","openSUSE-SU-2026:20828-1"],"status":"published","title":"Vim Ex command injection in Vims NetBeans integration","description":"Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00644,"percentile":0.51412,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2026-04-08T20:18:19Z","modified":"2026-11-03T06:32:55Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"vim","fixed_in":["9.2.0321-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"vim","fixed_in":["9.2.0321-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"vim","fixed_in":["9.2.0323-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"vim","fixed_in":["9.2.0321-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"vim","fixed_in":["9.2.0321-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"vim","fixed_in":["9.2.0321-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"vim-X11","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"vim-common","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"vim-enhanced","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"vim-filesystem","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"vim-minimal","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"vim-X11","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"vim-common","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"vim-enhanced","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"vim-filesystem","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"vim-minimal","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els63"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els63"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els63"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-common","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els63"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-doc","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els63"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els63"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els63"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els63"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els63"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els63"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els63"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gui-common","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els63"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els63"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els63"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-runtime","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els63"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-tiny","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els63"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"vim","fixed_in":["2:8.1.0875-5+deb10u6+tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"vim-athena","fixed_in":["2:8.1.0875-5+deb10u6+tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"vim-common","fixed_in":["2:8.1.0875-5+deb10u6+tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"vim-doc","fixed_in":["2:8.1.0875-5+deb10u6+tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"vim-gtk","fixed_in":["2:8.1.0875-5+deb10u6+tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"vim-gtk3","fixed_in":["2:8.1.0875-5+deb10u6+tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"vim-gui-common","fixed_in":["2:8.1.0875-5+deb10u6+tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"vim-nox","fixed_in":["2:8.1.0875-5+deb10u6+tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"vim-runtime","fixed_in":["2:8.1.0875-5+deb10u6+tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"vim-tiny","fixed_in":["2:8.1.0875-5+deb10u6+tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"xxd","fixed_in":["2:8.1.0875-5+deb10u6+tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"vim-X11","fixed_in":["2:7.4.629-8.0.1.el7_9.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"vim-common","fixed_in":["2:7.4.629-8.0.1.el7_9.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"vim-enhanced","fixed_in":["2:7.4.629-8.0.1.el7_9.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"vim-filesystem","fixed_in":["2:7.4.629-8.0.1.el7_9.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"vim-minimal","fixed_in":["2:7.4.629-8.0.1.el7_9.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"vim-X11","fixed_in":["2:7.4.629-8.0.1.el7_9.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"vim-common","fixed_in":["2:7.4.629-8.0.1.el7_9.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"vim-enhanced","fixed_in":["2:7.4.629-8.0.1.el7_9.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"vim-filesystem","fixed_in":["2:7.4.629-8.0.1.el7_9.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"vim-minimal","fixed_in":["2:7.4.629-8.0.1.el7_9.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vim","fixed_in":["2:9.1.1230-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vim","fixed_in":["2:9.2.0338-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"vim","fixed_in":["9.0-44.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"vim","fixed_in":["9.0-44.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"vim","fixed_in":["9.0.2092-30.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"vim","fixed_in":["9.0.2092-30.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"vim","fixed_in":["9.0.2092-30.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"vim","fixed_in":["2:8.2.2434-3+deb11u3.root.io.1","2:8.2.2434-3+deb11u3.aikido.5","2:8.2.2434-3+deb11u3.aikido.6","2:8.2.2434-3+deb11u3.aikido.7","2:8.2.2434-3+deb11u3.root.io.2","2:8.2.2434-3+deb11u3.root.io.4","2:8.2.2434-3+deb11u3.root.io.3","2:8.2.2434-3+deb11u3.aikido.8"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-vim","fixed_in":["2:8.2.2434-3+deb11u3.root.io.1","2:8.2.2434-3+deb11u3.aikido.5","2:8.2.2434-3+deb11u3.aikido.6","2:8.2.2434-3+deb11u3.aikido.7","2:8.2.2434-3+deb11u3.root.io.2","2:8.2.2434-3+deb11u3.root.io.4","2:8.2.2434-3+deb11u3.root.io.3","2:8.2.2434-3+deb11u3.aikido.8"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"vim","fixed_in":["2:9.0.1378-2+deb12u2.aikido.20","2:9.0.1378-2+deb12u2.root.io.17","2:9.0.1378-2+deb12u2.root.io.19","2:9.0.1378-2+deb12u2.root.io.18","2:9.0.1378-2+deb12u2.aikido.21"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-vim","fixed_in":["2:9.0.1378-2+deb12u2.aikido.20","2:9.0.1378-2+deb12u2.root.io.17","2:9.0.1378-2+deb12u2.root.io.19","2:9.0.1378-2+deb12u2.root.io.18","2:9.0.1378-2+deb12u2.aikido.21"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","fixed_in":["2:7.4.052-1ubuntu3.1+esm25"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vim","fixed_in":["2:7.4.1689-3ubuntu1.5+esm31"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vim","fixed_in":["2:8.0.1453-1ubuntu1.13+esm16"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"vim","fixed_in":["2:8.1.2269-1ubuntu5.32+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"vim","fixed_in":["2:8.2.3995-1ubuntu2.28"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"vim","fixed_in":["2:9.1.0016-1ubuntu7.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"vim","fixed_in":["2:9.1.0967-1ubuntu6.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"vim","fixed_in":["2:9.1.2141-1ubuntu4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0321-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0321-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0323-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0820-r2"},{"fixed":"9.2.0321-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.1415-r0"},{"fixed":"9.2.0321-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.1395-r0"},{"fixed":"9.2.0321-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els63"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els63"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els63"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els63"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els63"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els63"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els63"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els63"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els63"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els63"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els63"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gui-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els63"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els63"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els63"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els63"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els63"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-athena","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-gui-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"xxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_2.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_2.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_2.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_2.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_2.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.1.el7_9.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.1.el7_9.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.1.el7_9.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.1.el7_9.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.1.el7_9.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.1.el7_9.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.1.el7_9.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.1.el7_9.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.1.el7_9.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.1.el7_9.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els14"}]}],"bundled":21},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els14"}]}],"bundled":21},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els14"}]}],"bundled":21},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els14"}]}],"bundled":21},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els14"}]}],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-athena","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-gui-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"xxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"Debian:12","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:9.0.1378-2","2:9.0.1378-2+deb12u1","2:9.0.1378-2+deb12u2","2:9.0.1658-1","2:9.0.1672-1","2:9.0.1894-1","2:9.0.2018-1","2:9.0.2087-1","2:9.0.2103-1","2:9.0.2116-1","2:9.0.2189-1","2:9.1.0-1","2:9.1.0016-1","2:9.1.0199-1","2:9.1.0374-1","2:9.1.0377-1","2:9.1.0496-1","2:9.1.0698-1","2:9.1.0709-1","2:9.1.0709-2","2:9.1.0777-1","2:9.1.0861-1","2:9.1.0967-1","2:9.1.0967-2","2:9.1.1113-1","2:9.1.1230-1","2:9.1.1230-2","2:9.1.1385-1","2:9.1.1766-1","2:9.1.1829-1","2:9.1.1846-1","2:9.1.1882-1","2:9.1.2103-1","2:9.1.2141-1","2:9.2.0119-1","2:9.2.0136-1","2:9.2.0218-1","2:9.2.0315-1","2:9.2.0338-1","2:9.2.0355-1","2:9.2.0428-1","2:9.2.0461-1","2:9.2.0524-1","2:9.2.0782-1","2:9.2.0858-1"]},{"source":"osv","ecosystem":"Debian:13","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.1230-2+deb13u1"}]}],"versions":["2:9.1.1230-2"]},{"source":"osv","ecosystem":"Debian:14","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.2.0338-1"}]}],"versions":["2:9.1.1230-2","2:9.1.1385-1","2:9.1.1766-1","2:9.1.1829-1","2:9.1.1846-1","2:9.1.1882-1","2:9.1.2103-1","2:9.1.2141-1","2:9.2.0119-1","2:9.2.0136-1","2:9.2.0218-1","2:9.2.0315-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.437-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-44.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-44.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2092-30.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2092-30.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2092-30.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-default-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"xxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17},{"source":"osv","ecosystem":"Root:Debian:11","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2434-3+deb11u3.root.io.1"},{"fixed":"2:8.2.2434-3+deb11u3.aikido.5"},{"fixed":"2:8.2.2434-3+deb11u3.aikido.6"},{"fixed":"2:8.2.2434-3+deb11u3.aikido.7"},{"fixed":"2:8.2.2434-3+deb11u3.root.io.2"},{"fixed":"2:8.2.2434-3+deb11u3.root.io.4"},{"fixed":"2:8.2.2434-3+deb11u3.root.io.3"},{"fixed":"2:8.2.2434-3+deb11u3.aikido.8"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2434-3+deb11u3.root.io.1"},{"fixed":"2:8.2.2434-3+deb11u3.aikido.5"},{"fixed":"2:8.2.2434-3+deb11u3.aikido.6"},{"fixed":"2:8.2.2434-3+deb11u3.aikido.7"},{"fixed":"2:8.2.2434-3+deb11u3.root.io.2"},{"fixed":"2:8.2.2434-3+deb11u3.root.io.4"},{"fixed":"2:8.2.2434-3+deb11u3.root.io.3"},{"fixed":"2:8.2.2434-3+deb11u3.aikido.8"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.0.1378-2+deb12u2.aikido.20"},{"fixed":"2:9.0.1378-2+deb12u2.root.io.17"},{"fixed":"2:9.0.1378-2+deb12u2.root.io.19"},{"fixed":"2:9.0.1378-2+deb12u2.root.io.18"},{"fixed":"2:9.0.1378-2+deb12u2.aikido.21"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.0.1378-2+deb12u2.aikido.20"},{"fixed":"2:9.0.1378-2+deb12u2.root.io.17"},{"fixed":"2:9.0.1378-2+deb12u2.root.io.19"},{"fixed":"2:9.0.1378-2+deb12u2.root.io.18"},{"fixed":"2:9.0.1378-2+deb12u2.aikido.21"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0530-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0530-150000.5.94.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0530-150000.5.94.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0530-150000.5.94.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0530-150000.5.94.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0530-150000.5.94.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0530-150000.5.94.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.052-1ubuntu3.1+esm25"}]}],"versions":["2:7.4.000-1ubuntu2","2:7.4.052-1ubuntu1","2:7.4.052-1ubuntu2","2:7.4.052-1ubuntu3","2:7.4.052-1ubuntu3.1","2:7.4.052-1ubuntu3.1+esm1","2:7.4.052-1ubuntu3.1+esm3","2:7.4.052-1ubuntu3.1+esm4","2:7.4.052-1ubuntu3.1+esm5","2:7.4.052-1ubuntu3.1+esm6","2:7.4.052-1ubuntu3.1+esm7","2:7.4.052-1ubuntu3.1+esm8","2:7.4.052-1ubuntu3.1+esm9","2:7.4.052-1ubuntu3.1+esm10","2:7.4.052-1ubuntu3.1+esm11","2:7.4.052-1ubuntu3.1+esm12","2:7.4.052-1ubuntu3.1+esm13","2:7.4.052-1ubuntu3.1+esm14","2:7.4.052-1ubuntu3.1+esm15","2:7.4.052-1ubuntu3.1+esm16","2:7.4.052-1ubuntu3.1+esm17","2:7.4.052-1ubuntu3.1+esm18","2:7.4.052-1ubuntu3.1+esm19","2:7.4.052-1ubuntu3.1+esm20","2:7.4.052-1ubuntu3.1+esm21","2:7.4.052-1ubuntu3.1+esm22","2:7.4.052-1ubuntu3.1+esm23","2:7.4.052-1ubuntu3.1+esm24"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.1689-3ubuntu1.5+esm31"}]}],"versions":["2:7.4.712-2ubuntu4","2:7.4.826-1ubuntu1","2:7.4.826-1ubuntu2","2:7.4.826-1ubuntu3","2:7.4.963-1ubuntu1","2:7.4.963-1ubuntu4","2:7.4.963-1ubuntu5","2:7.4.1689-3ubuntu1","2:7.4.1689-3ubuntu1.1","2:7.4.1689-3ubuntu1.2","2:7.4.1689-3ubuntu1.3","2:7.4.1689-3ubuntu1.4","2:7.4.1689-3ubuntu1.5","2:7.4.1689-3ubuntu1.5+esm2","2:7.4.1689-3ubuntu1.5+esm3","2:7.4.1689-3ubuntu1.5+esm4","2:7.4.1689-3ubuntu1.5+esm5","2:7.4.1689-3ubuntu1.5+esm6","2:7.4.1689-3ubuntu1.5+esm7","2:7.4.1689-3ubuntu1.5+esm8","2:7.4.1689-3ubuntu1.5+esm10","2:7.4.1689-3ubuntu1.5+esm11","2:7.4.1689-3ubuntu1.5+esm12","2:7.4.1689-3ubuntu1.5+esm13","2:7.4.1689-3ubuntu1.5+esm14","2:7.4.1689-3ubuntu1.5+esm15","2:7.4.1689-3ubuntu1.5+esm17","2:7.4.1689-3ubuntu1.5+esm18","2:7.4.1689-3ubuntu1.5+esm19","2:7.4.1689-3ubuntu1.5+esm20","2:7.4.1689-3ubuntu1.5+esm22","2:7.4.1689-3ubuntu1.5+esm23","2:7.4.1689-3ubuntu1.5+esm24","2:7.4.1689-3ubuntu1.5+esm25","2:7.4.1689-3ubuntu1.5+esm26","2:7.4.1689-3ubuntu1.5+esm27","2:7.4.1689-3ubuntu1.5+esm28","2:7.4.1689-3ubuntu1.5+esm29","2:7.4.1689-3ubuntu1.5+esm30"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+esm16"}]}],"versions":["2:8.0.0197-4ubuntu5","2:8.0.1144-1ubuntu1","2:8.0.1401-1ubuntu1","2:8.0.1401-1ubuntu2","2:8.0.1401-1ubuntu3","2:8.0.1453-1ubuntu1","2:8.0.1453-1ubuntu1.1","2:8.0.1453-1ubuntu1.3","2:8.0.1453-1ubuntu1.4","2:8.0.1453-1ubuntu1.6","2:8.0.1453-1ubuntu1.7","2:8.0.1453-1ubuntu1.8","2:8.0.1453-1ubuntu1.9","2:8.0.1453-1ubuntu1.10","2:8.0.1453-1ubuntu1.11","2:8.0.1453-1ubuntu1.12","2:8.0.1453-1ubuntu1.13","2:8.0.1453-1ubuntu1.13+esm1","2:8.0.1453-1ubuntu1.13+esm3","2:8.0.1453-1ubuntu1.13+esm4","2:8.0.1453-1ubuntu1.13+esm5","2:8.0.1453-1ubuntu1.13+esm6","2:8.0.1453-1ubuntu1.13+esm7","2:8.0.1453-1ubuntu1.13+esm8","2:8.0.1453-1ubuntu1.13+esm9","2:8.0.1453-1ubuntu1.13+esm10","2:8.0.1453-1ubuntu1.13+esm11","2:8.0.1453-1ubuntu1.13+esm12","2:8.0.1453-1ubuntu1.13+esm13","2:8.0.1453-1ubuntu1.13+esm14","2:8.0.1453-1ubuntu1.13+esm15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2269-1ubuntu5.32+esm4"}]}],"versions":["2:8.1.0875-5ubuntu2","2:8.1.0875-5ubuntu3","2:8.1.0875-5ubuntu4","2:8.1.2269-1ubuntu1","2:8.1.2269-1ubuntu4","2:8.1.2269-1ubuntu5","2:8.1.2269-1ubuntu5.3","2:8.1.2269-1ubuntu5.4","2:8.1.2269-1ubuntu5.6","2:8.1.2269-1ubuntu5.7","2:8.1.2269-1ubuntu5.8","2:8.1.2269-1ubuntu5.9","2:8.1.2269-1ubuntu5.11","2:8.1.2269-1ubuntu5.12","2:8.1.2269-1ubuntu5.13","2:8.1.2269-1ubuntu5.14","2:8.1.2269-1ubuntu5.15","2:8.1.2269-1ubuntu5.16","2:8.1.2269-1ubuntu5.17","2:8.1.2269-1ubuntu5.18","2:8.1.2269-1ubuntu5.20","2:8.1.2269-1ubuntu5.21","2:8.1.2269-1ubuntu5.22","2:8.1.2269-1ubuntu5.23","2:8.1.2269-1ubuntu5.24","2:8.1.2269-1ubuntu5.25","2:8.1.2269-1ubuntu5.26","2:8.1.2269-1ubuntu5.29","2:8.1.2269-1ubuntu5.30","2:8.1.2269-1ubuntu5.31","2:8.1.2269-1ubuntu5.32","2:8.1.2269-1ubuntu5.32+esm2","2:8.1.2269-1ubuntu5.32+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.3995-1ubuntu2.28"}]}],"versions":["2:8.2.2434-3ubuntu3","2:8.2.2434-3ubuntu4","2:8.2.3565-1ubuntu1","2:8.2.3565-1ubuntu2","2:8.2.3565-1ubuntu3","2:8.2.3565-1ubuntu5","2:8.2.3995-1ubuntu1","2:8.2.3995-1ubuntu2","2:8.2.3995-1ubuntu2.1","2:8.2.3995-1ubuntu2.3","2:8.2.3995-1ubuntu2.4","2:8.2.3995-1ubuntu2.5","2:8.2.3995-1ubuntu2.7","2:8.2.3995-1ubuntu2.8","2:8.2.3995-1ubuntu2.9","2:8.2.3995-1ubuntu2.10","2:8.2.3995-1ubuntu2.11","2:8.2.3995-1ubuntu2.12","2:8.2.3995-1ubuntu2.13","2:8.2.3995-1ubuntu2.15","2:8.2.3995-1ubuntu2.16","2:8.2.3995-1ubuntu2.17","2:8.2.3995-1ubuntu2.18","2:8.2.3995-1ubuntu2.19","2:8.2.3995-1ubuntu2.20","2:8.2.3995-1ubuntu2.21","2:8.2.3995-1ubuntu2.22","2:8.2.3995-1ubuntu2.23","2:8.2.3995-1ubuntu2.24","2:8.2.3995-1ubuntu2.26","2:8.2.3995-1ubuntu2.27"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.0016-1ubuntu7.12"}]}],"versions":["2:9.0.1672-1ubuntu2","2:9.0.2087-1ubuntu1","2:9.0.2116-1ubuntu1","2:9.0.2116-1ubuntu2","2:9.0.2184-0ubuntu1","2:9.0.2189-1ubuntu1","2:9.1.0-1ubuntu1","2:9.1.0016-1ubuntu2","2:9.1.0016-1ubuntu6","2:9.1.0016-1ubuntu7","2:9.1.0016-1ubuntu7.1","2:9.1.0016-1ubuntu7.2","2:9.1.0016-1ubuntu7.3","2:9.1.0016-1ubuntu7.4","2:9.1.0016-1ubuntu7.5","2:9.1.0016-1ubuntu7.6","2:9.1.0016-1ubuntu7.7","2:9.1.0016-1ubuntu7.8","2:9.1.0016-1ubuntu7.9","2:9.1.0016-1ubuntu7.10","2:9.1.0016-1ubuntu7.11"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.0967-1ubuntu6.3"}]}],"versions":["2:9.1.0967-1ubuntu4","2:9.1.0967-1ubuntu5","2:9.1.0967-1ubuntu6","2:9.1.0967-1ubuntu6.1","2:9.1.0967-1ubuntu6.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.2141-1ubuntu4.1"}]}],"versions":["2:9.1.0967-1ubuntu6","2:9.1.1882-1ubuntu1","2:9.1.1882-1ubuntu2","2:9.1.2141-1ubuntu1","2:9.1.2141-1ubuntu2","2:9.1.2141-1ubuntu4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0398-1.1"}]}],"bundled":4}],"products":[{"vendor":"vim","product":"vim"}],"references":[{"url":"https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/vim/vim/commit/7ab76a86048ed492374ac6b19","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0316","tags":["x_refsource_MISC","Release Notes","web","article"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-39881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39881","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-39881","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1777567716.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1777568566.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1777625424.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1777889241.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1777942049.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1777943581.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1778020398.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1778021665.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1779356802.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787304699.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22667","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25749","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26269","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28417","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28421","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33412","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34982","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35177","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41411","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39881.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-39881","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0123.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35332","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/07/13","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/15/7","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8","tags":["advisory","article"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/22/8","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/03/11","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-hwg5-3cxw-wvvg","tags":["advisory","article"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2003","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2004","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2005","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2006","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2007","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57614","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73073","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-57451","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-57453","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-57454","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52860","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52858","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52859","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-47167","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-47162","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-46483","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45130","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44656","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43961","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41411","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-35177","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34982","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39881","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57614.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455400","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34982","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/01/1","tags":["article"]},{"url":"https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0276","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455542","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-35177","tags":["advisory"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-jc86-w7vm-8p24","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456722","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39881","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461614","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41411","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0357","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460434","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43961","tags":["advisory"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468420","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44656","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44656","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0435","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468422","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45130","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45130","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/92993329178cb1f72d700fff45ca86e1c2d369f8","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0450","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-q4jv-r9gj-6cwv","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477915","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46483","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46483","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0479","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487964","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47162","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47162","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0495","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487996","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47167","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0496","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487981","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52858","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0561","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487989","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52859","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/63680c6d3d52477817b49cd1a66e7aabe8a7aa19","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0565","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-47gw-8gc3-mgcm","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487987","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52860","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/c8c63673bc4253212820626aeeb75999d9a539d2","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0597","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57451","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57451","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/b2338ca90643e2f01ecb6547c1172716aaec4f79","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0670","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-f36c-2qcp-7gpw","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492967","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57453","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57453","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/b2cc9be119d51212bf0d3f2a99","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0678","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-x5fg-h5w9-9frf","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492977","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57454","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57454","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/b3faeecc976d3031d7c0675623516ec60c30f949","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0679","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-ww8h-47xp-hp4w","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517950","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73073","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73073","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/2f628d8104958fa7421664f792ca6d4f7a39a10f","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0845","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-cx73-phcg-3j5g","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261764-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261833","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39881","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262029-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621414-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621450-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621833-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262395","tags":["report"]},{"url":"https://bugzilla.suse.com/1264706","tags":["report"]},{"url":"https://bugzilla.suse.com/1264707","tags":["report"]},{"url":"https://bugzilla.suse.com/1264708","tags":["report"]},{"url":"https://bugzilla.suse.com/1265349","tags":["report"]},{"url":"https://bugzilla.suse.com/1265360","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46483","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621840-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621859-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262313-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-39881","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8213-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8246-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34982","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-39881","title":"Vim Ex command injection in Vims NetBeans integration","description":"Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.","status":"published","published":"2026-04-08T20:18:19.774Z","modified":"2026-04-09T13:50:24.001Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:20:02.662847Z"}],"euvd":[{"id":"EUVD-2026-20622","description":"Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.","status":"published","published":"2026-04-08T20:18:19Z","modified":"2026-04-09T13:50:24Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:31.230458Z"}],"nvd":[{"id":"CVE-2026-39881","description":"Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.","status":"published","published":"2026-04-08T21:17:00.4Z","modified":"2026-07-24T21:10:00.143Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:13.902911Z"}],"osv":[{"id":"ALPINE-CVE-2026-39881","description":"Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.","status":"published","published":"2026-04-08T21:17:00.4Z","modified":"2026-11-03T06:32:55.419374834Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"BELL-CVE-2026-39881","status":"published","published":"2026-04-09T01:49:03.966631Z","modified":"2026-04-25T07:22:32.315831Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"CVE-2026-39881","title":"Vim Ex command injection in Vims NetBeans integration","description":"Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.","status":"published","published":"2026-04-08T20:18:19.774Z","modified":"2026-11-11T13:23:15.113388841Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-11T03:21:32.226287Z"},{"id":"DEBIAN-CVE-2026-39881","description":"Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.","status":"published","published":"2026-04-08T21:17:00.4Z","modified":"2026-11-01T19:00:41.025473272Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"OESA-2026-2003","title":"vim security update","description":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor \u0026amp;apos;Vi\u0026amp;apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\nSecurity Fix(es):\n\nVim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim\u0026apos;s netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.(CVE-2026-39881)","status":"published","published":"2026-04-25T11:11:00Z","modified":"2026-08-18T01:19:48.165329233Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2004","title":"vim security update","description":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor \u0026amp;apos;Vi\u0026amp;apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\nSecurity Fix(es):\n\nVim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim\u0026apos;s netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.(CVE-2026-39881)","status":"published","published":"2026-04-25T11:11:00Z","modified":"2026-08-18T01:19:48.349737417Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2005","title":"vim security update","description":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor \u0026amp;apos;Vi\u0026amp;apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\nSecurity Fix(es):\n\nVim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim\u0026apos;s netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.(CVE-2026-39881)","status":"published","published":"2026-04-25T11:11:00Z","modified":"2026-08-18T01:19:44.463675814Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2006","title":"vim security update","description":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor \u0026amp;apos;Vi\u0026amp;apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\nSecurity Fix(es):\n\nVim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim\u0026apos;s netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.(CVE-2026-39881)","status":"published","published":"2026-04-25T11:11:00Z","modified":"2026-08-18T01:19:44.449818261Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2007","title":"vim security update","description":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor \u0026amp;apos;Vi\u0026amp;apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\nSecurity Fix(es):\n\nVim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim\u0026apos;s netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.(CVE-2026-39881)","status":"published","published":"2026-04-25T11:11:00Z","modified":"2026-08-18T01:19:48.404389552Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"RHSA-2026:57614","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-12T10:09:11Z","modified":"2026-10-17T10:16:12Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-39881","title":"CVE-2026-39881 in vim - Patched by Root","description":"Root has patched CVE-2026-39881 in the vim package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-31T08:18:29Z","modified":"2026-08-31T09:15:08.272174978Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-39881","title":"CVE-2026-39881 in vim - Patched by Root","description":"Root has patched CVE-2026-39881 in the vim package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-26T07:45:37Z","modified":"2026-08-26T09:00:10.599978583Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"UBUNTU-CVE-2026-39881","description":"Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.","status":"published","published":"2026-04-08T21:17:00Z","modified":"2026-05-20T16:25:39.567743916Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"AZL-82010","title":"CVE-2026-39881 affecting package vim for versions less than 9.2.0323-1","description":"Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.","status":"published","published":"2026-04-08T21:17:00Z","modified":"2026-08-28T17:56:25.385723Z","updated_at":"2026-11-02T15:28:10.335477Z"},{"id":"CLSA-2026-1777567716","title":"vim: Fix of CVE-2026-39881","description":"- CVE-2026-39881: fix command injection in netbeans interface by validating\n  defineAnnoType typeName/fg/bg and specialKeys tokens against an allowlist\n  of safe characters before interpolating them into Ex commands","status":"published","published":"2026-04-30T16:48:42Z","modified":"2026-06-01T00:33:25.929470885Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777568566","title":"vim: Fix of CVE-2026-39881","description":"- CVE-2026-39881: fix command injection in netbeans interface by validating\n  defineAnnoType typeName/fg/bg and specialKeys tokens against an allowlist\n  of safe characters before interpolating them into Ex commands","status":"published","published":"2026-05-05T21:18:06Z","modified":"2026-06-01T00:33:16.866794361Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777625424","title":"Fix CVE(s): CVE-2026-39881","description":"   * SECURITY UPDATE: Command injection in netbeans interface\n     - debian/patches/CVE-2026-39881.patch: add nb_is_safe_string() in\n       src/netbeans.c and validate typeName, fg and bg in defineAnnoType\n       and key tokens in special_keys() against an allowlist before they\n       reach coloncmd()/do_map(), preventing a malicious netbeans server\n       from injecting Ex commands via '|'\n     - CVE-2026-39881","status":"published","published":"2026-05-01T08:50:30Z","modified":"2026-06-04T10:04:19.957066Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777889241","title":"vim: Fix of 2 CVEs","description":"- CVE-2026-35177: fix path traversal bypass in zip.vim by using simplify() to\n  detect attacks that circumvent the previous regex-only check\n- CVE-2026-39881: fix command injection in netbeans interface via unsanitized\n  defineAnnoType and specialKeys parameters","status":"published","published":"2026-05-04T10:07:26Z","modified":"2026-06-01T00:32:51.12224672Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1777942049","title":"Fix CVE(s): CVE-2026-39881","description":"   * SECURITY UPDATE: fix command injection in netbeans interface via defineAnnoType (validate typeName/fg/bg/specialKeys)\n     - debian/patches/CVE-2026-39881.patch: fix command injection in netbeans interface via defineAnnoType (validate typeName/fg/bg/specialKeys)\n     - CVE-2026-39881","status":"published","published":"2026-05-05T00:47:38Z","modified":"2026-06-04T10:03:15.192004Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1777943581","title":"vim: Fix of 2 CVEs","description":"- CVE-2026-35177: fix path traversal bypass in zip.vim by using simplify() to\n  detect attacks that circumvent the previous regex-only check\n- CVE-2026-39881: fix command injection in netbeans interface via unsanitized\n  defineAnnoType and specialKeys parameters","status":"published","published":"2026-05-05T01:13:07Z","modified":"2026-06-01T00:31:49.038811229Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778020398","title":"vim: Fix of CVE-2026-39881","description":"- CVE-2026-39881: fix netbeans defineAnnoType command injection by validating\n  typeName, fg and bg against an allowlist before passing them to coloncmd();\n  also restrict specialKeys tokens to alphanumeric characters to prevent map\n  command injection","status":"published","published":"2026-05-05T22:33:26Z","modified":"2026-06-01T00:33:14.173712952Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778021665","title":"vim: Fix of CVE-2026-39881","description":"- CVE-2026-39881: fix netbeans defineAnnoType command injection by validating\n  typeName, fg and bg against an allowlist before passing them to coloncmd();\n  also restrict specialKeys tokens to alphanumeric characters to prevent map\n  command injection","status":"published","published":"2026-05-07T17:02:21Z","modified":"2026-06-01T00:33:18.785897729Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779356802","title":"vim: Fix of 21 CVEs","description":"- CVE-2022-0572: heap overflow on vcol-overflow in :retab (upstream vim 8.2.4359)\n- CVE-2022-0368: illegal memory access when undo makes Visual area invalid (upstream vim 8.2.4217)\n- CVE-2022-0685: crash on multi-byte char in unix_expandpath() (upstream vim 8.2.4418)\n- CVE-2022-2125: heap overflow in get_lisp_indent() (upstream vim 8.2.5122)\n- CVE-2022-2183: reading past end-of-line in lisp indenting (upstream vim 8.2.5151)\n- CVE-2022-2124: reading past end-of-line in current_quote() (upstream vim 8.2.5120)\n- CVE-2022-2344: heap overflow in ins_compl_add() (upstream vim 9.0.0046)\n- CVE-2022-3256: use-after-free in movemark() when autocmd changes mark (upstream vim 9.0.0530)\n- CVE-2023-4752: heap use-after-free in ins_compl_get_exp() (upstream vim 9.0.1858)\n- CVE-2022-2126: spell-suggest read past bad word (upstream vim 8.2.5123)\n- CVE-2022-2946: use-after-free in do_tag() when tagfunc invalidates tagstack (upstream vim 9.0.0246)\n- CVE-2022-1720: OOB read in get_visual_text() (upstream vim 8.2.4956)\n- CVE-2022-3234: OOB write in op_replace() (upstream vim 9.0.0483)\n- CVE-2023-0433: same_leader() read past end-of-line on short comment line (upstream vim 9.0.1225)\n- CVE-2023-4781: heap-buffer-overflow in vim_regsub_both() via nmatch underflow in :substitute, plus textlock guard in win_exchange() (upstream vim 9.0.1873)\n- CVE-2022-0351: crash on deeply nested expression (upstream vim 8.2.4206)\n- CVE-2022-2175: new_cmdpos leak across register insertion in getcmdline() (upstream vim 8.2.5148)\n- CVE-2026-39881: netbeans command injection via crafted sign/highlight identifier + special-keys (upstream vim 9.2.0316)\n- CVE-2021-4166: heap-buffer-overflow when clearing the argument list while it is being used (upstream vim 8.2.3884, with 8.2.2421 + 8.2.2463 prereqs for arglist_locked plumbing)\n- CVE-2022-2343: heap-buffer-overflow in ins_compl_add_infercase() on long line with 'infercase' (upstream vim 9.0.0045)\n- CVE-2022-3296: stack underflow in ex_finally / ex_endtry when :finally lacks an enclosing :try (upstream vim 9.0.0577)","status":"published","published":"2026-05-21T09:46:46Z","modified":"2026-10-21T10:47:11.254162783Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1787304699","title":"Fix of 10 CVEs","description":"   * SECURITY UPDATE: stack-based buffer overflow in option callback\n     functions: illegal_char() and did_set_string_option() wrote the\n     E539/E526/E535 option errors into the caller's 80-byte errbuf[] with\n     unbounded sprintf().  The call site reported upstream,\n     did_set_langmap() in src/map.c, does not exist in this version, where\n     'langmap' errors are reported through EMSG2() into a bounded buffer.\n     - debian/patches/CVE-2024-22667.patch: introduce ERR_BUFLEN and use\n       snprintf() bounded by it at the three sprintf() sites, in\n       src/option.c and src/option.h; matches upstream patch 9.0.2142.\n     - CVE-2024-22667\n   * SECURITY UPDATE: buffer overflow in 'helpfile' option handling:\n     get_tagfname() copied the user-controlled 'helpfile' value into a\n     MAXPATHL buffer with STRCPY() and then appended \"tags\" at the tail, so\n     an over-long 'helpfile' overflowed the buffer.\n     - debian/patches/CVE-2026-25749.patch: bound the copy with\n       vim_strncpy() leaving room for the \"tags\" suffix, in src/tag.c;\n       matches upstream patches 9.1.2132 and 9.1.2133.\n     - CVE-2026-25749\n   * SECURITY UPDATE: buffer overflow in the netbeans specialKeys command:\n     special_keys() walked the modifier prefix writing two bytes per\n     modifier into the 64-byte keybuf[] with no bound, so a long modifier\n     run overflowed it.\n     - debian/patches/CVE-2026-26269.patch: stop the modifier loop while\n       i + 2 \u003c KEYBUFLEN, in src/netbeans.c; matches upstream patch\n       9.1.2148.\n     - CVE-2026-26269\n   * SECURITY UPDATE: command injection via netrw URIs: the hostname and\n     port taken from a netrw URI were interpolated unescaped into the\n     command passed to system(), so shell metacharacters in the host or\n     port ran arbitrary commands.\n     - debian/patches/CVE-2026-28417.patch: validate the host against an\n       RFC1123 hostname / IPv4 / IPv6 pattern at the four netrw entry\n       points and shellescape() the host, user and port in s:MakeSshCmd(),\n       in runtime/autoload/netrw.vim; matches upstream patches 9.2.0073,\n       9.2.0089 and 9.2.0553.\n     - CVE-2026-28417\n   * SECURITY UPDATE: crash and huge allocation recovering a corrupted swap\n     file: ml_recover() trusted pe_page_count, pe_bnum, pe_old_lnum and\n     pe_line_count from the swap file, so bogus values caused a multi-GB\n     mf_get() allocation or a SEGV inside readfile().\n     - debian/patches/CVE-2026-28421.patch: bound pe_page_count and\n       pe_bnum against mf_blocknr_max and validate pe_old_lnum and\n       pe_line_count before use, in src/memline.c; matches upstream patch\n       9.2.0077.\n     - CVE-2026-28421\n   * SECURITY UPDATE: command injection via newline in glob(): the newline\n     character was missing from SHELL_SPECIAL, so it was not escaped before\n     mch_expand_wildcards() handed the pattern to the shell and could act\n     as a command separator.\n     - debian/patches/CVE-2026-33412.patch: add '\\n' to SHELL_SPECIAL, in\n       src/os_unix.c; matches upstream patch 9.2.0202.\n     - CVE-2026-33412\n   * SECURITY UPDATE: modeline security bypass: several options holding\n     expressions could be set from a modeline, so opening a crafted file\n     evaluated attacker-supplied expressions.  In this version the\n     expressions reachable this way are the 'statusline'-style %{} items of\n     'printheader' and 'guitabtooltip', which were evaluated in the sandbox\n     only; the F{func} flag of 'complete' and the mapset() function named by\n     the upstream advisory arrived in later releases and are not present in\n     this version.\n     - debian/patches/patch-8.1.1366-using-expressions-in-a-modeline-is-unsafe.patch:\n       add the 'modelineexpr' option and the P_MLE flag,\n       refuse P_MLE options in a modeline unless 'modelineexpr' is set,\n       mark the expression-bearing options P_MLE, and document\n       'modelineexpr' and E992, in src/option.c, src/option.h and\n       runtime/doc/options.txt; prerequisite for the fix below.\n     - debian/patches/patch-8.1.1367-can-set-modelineexpr-in-modeline.patch:\n       mark 'modelineexpr' itself P_SECURE so a modeline cannot enable it,\n       and document that, in src/option.c and runtime/doc/options.txt;\n       without this the check above can be turned off by the crafted file\n       itself.\n     - debian/patches/CVE-2026-34982.patch: mark 'complete',\n       'guitabtooltip' and 'printheader' P_MLE, in src/option.c; matches\n       upstream patch 9.2.0276.\n     - CVE-2026-34982\n   * SECURITY UPDATE: path traversal in zip.vim: neither zip#Write() nor\n     zip#Extract() rejected archive members whose path escaped the\n     extraction directory, so a crafted zip could write outside it.\n     - debian/patches/CVE-2026-35177.patch: reject any path that simplifies\n       to one containing \"../\" in both zip#Write() and zip#Extract(), in\n       runtime/autoload/zip.vim; matches upstream patch 9.2.0280.\n     - CVE-2026-35177\n   * SECURITY UPDATE: command injection in the netbeans interface via\n     defineAnnoType: typeName, fg and bg arrived unvalidated from the\n     NetBeans server and were interpolated into an Ex command, so a bar\n     could append arbitrary commands; specialKeys likewise built a map\n     command from an unvalidated key token.\n     - debian/patches/CVE-2026-39881.patch: validate typeName, fg and bg\n       against character allowlists and accept only alphanumerics and '-'\n       in a specialKeys token, in src/netbeans.c; matches upstream patch\n       9.2.0316.\n     - CVE-2026-39881\n   * SECURITY UPDATE: command injection via backticks in tag files:\n     expand_tag_fname() passed a tag filename containing backticks to\n     wildcard expansion, which ran it through the shell.\n     - debian/patches/CVE-2026-41411.patch: refuse to expand a tag filename\n       containing a backtick, in src/tag.c; matches upstream patch\n       9.2.0357.\n     - CVE-2026-41411\n   * NOTE: behaviour change that comes with the 'modelineexpr' mechanism\n     above: options that hold an expression ('balloonexpr', 'foldexpr',\n     'foldtext', 'formatexpr', 'guitablabel', 'iconstring', 'includeexpr',\n     'indentexpr', 'rulerformat', 'statusline', 'tabline', 'titlestring',\n     'complete', 'guitabtooltip' and 'printheader') can no longer be set\n     from a modeline unless the new 'modelineexpr' option is on, and are\n     refused with E992.  'cdpath' becomes modeline- and sandbox-refused\n     (E520).  This is the upstream 8.1.1366 behaviour; see\n     :help modelineexpr.\n   * debian/patches/fix-Test_terminal_cwd.patch: join the first two terminal\n     lines before comparing in Test_terminal_cwd(), so the test still passes\n     when the build path is long enough for the pwd output to wrap; matches\n     upstream patch 9.0.0541.","status":"published","published":"2026-08-21T09:31:57Z","modified":"2026-10-26T09:31:47.599230366Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"MGASA-2026-0123","title":"Updated vim packages fix security vulnerabilities","description":"Ex command injection in Vims NetBeans integration. (CVE-2026-39881)\nCommand injection via backtick expansion in tag filenames in Vim \u003c\nv9.2.0357. (CVE-2026-41411)\nOS Command Injection in netrw affects Vim \u003c 9.2.0383. (CVE-2026-42307)\nOS Command Injection via 'path' completion affects Vim \u003c 9.2.0435.\n","status":"published","published":"2026-05-09T16:24:29Z","modified":"2026-05-09T16:34:07.985314Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10652-1","title":"gvim-9.2.0398-1.1 on GA media","description":"These are all security issues fixed in the gvim-9.2.0398-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-28T00:00:00Z","modified":"2026-04-29T08:02:25.229766Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20828-1","title":"Security update for vim","description":"This update for vim fixes the following issues\n\n- CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).\n- CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin\n  bundled with Vim (bsc#1264706).\n- CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).\n- CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line\n  completion (bsc#1264707).\n- CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when\n  loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).\n- CVE-2026-46483: command injection via ` tar#Vimuntar()` in `runtime/autoload/tar.vim` when decompressing `.tgz`\n  archives on Unix-like systems (bsc#1265360).\n\nChanges for vim:\n\n- Update to v9.2.0530.\n- Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)\n","status":"published","published":"2026-05-28T12:13:40Z","modified":"2026-05-31T18:24:29.198231999Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:1764-1","title":"Security update for vim","description":"This update for vim fixes the following issue:\n\nSecurity fixes:\n\n- CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).\n\nOther fixes:\n\n- Update to 9.2.0398.\n * 9.2.0398: MS-Windows: missing strptime() support\n * 9.2.0397: tabpanel: double-click opens a new tab\n * 9.2.0396: tests: Test_error_callback_terminal is flaky on macOS\n * 9.2.0395: tests: Test_backupskip() may read from $HOME\n * 9.2.0394: xxd: offsets greater than LONG_MAX print as negative\n * 9.2.0393: MS-Windows: link error with XPM support on UCRT64\n * 9.2.0392: tests: Some tests are flaky\n * 9.2.0391: tests: Comment in test_vim9_cmd breaks syntax highlighting\n * 9.2.0390: filetype: some Beancount files are not recognized\n * 9.2.0389: DECRQM still leaves stray 'pp' on Apple Terminal.app\n * 9.2.0388: strange indent in update_topline()\n * 9.2.0387: DECRQM request may leave stray chars in terminal\n * 9.2.0386: No scroll/scrollbar support in the tabpanel\n * 9.2.0385: Integer overflow with 'ze' and large 'sidescrolloff'\n * 9.2.0384: stale Insstart after \u003cCmd\u003e cursor move breaks undo\n * 9.2.0383: [security]: runtime(netrw): shell-injection via sftp: and file: URLs\n * 9.2.0382: Wayland: focus-stealing is non-working\n * 9.2.0381: Vim9: Missing check_secure() in exec_instructions()\n * 9.2.0380: completion: a few issues in completion code\n * 9.2.0379: gui.color_approx is never used\n * 9.2.0378: Using int as bool type in win_T struct\n * 9.2.0377: Using int as bool type in gui_T struct\n * 9.2.0376: Vim9: elseif condition compiled in dead branch\n * 9.2.0375: prop_find() does not find a virt text in starting line\n * 9.2.0374: c_CTRL-{G,T} does not handle offset\n * 9.2.0373: Ctrl-R mapping not triggered during completion\n * 9.2.0372: pum: rendering issues with multibyte text and opacity\n * 9.2.0371: filetype: ghostty config files are not recognized\n * 9.2.0370: duplicate code with literal string_T assignment\n * 9.2.0369: multiple definitions of STRING_INIT macro\n * 9.2.0368: too many strlen() calls when adding strings to dicts\n * 9.2.0367: runtime(netrw): ~ note expanded on MS Windows\n * 9.2.0366: pum: flicker when updating pum in place\n * 9.2.0365: using int as bool\n * 9.2.0364: tests: test_smoothscroll_textoff_showbreak() fails\n * 9.2.0363: Vim9: variable shadowed by script-local function\n * 9.2.0362: division by zero with smoothscroll and small windows\n * 9.2.0361: tests: no tests for ch_listen() with IPs\n * 9.2.0360: Cannot handle mouse-clicks in the tabpanel\n * 9.2.0359: wrong VertSplitNC highlighting on winbar\n * 9.2.0358: runtime(vimball): still path traversal attacks possible\n * 9.2.0357: [security]: command injection via backticks in tag files\n * 9.2.0356: Cannot apply 'scrolloff' context lines at end of file\n * 9.2.0355: runtime(tar): missing path traversal checks in tar#Extract()\n * 9.2.0354: filetype: not all Bitbake include files are recognized\n * 9.2.0353: Missing out-of-memory check in register.c\n * 9.2.0352: 'winhighlight' of left window blends into right window\n * 9.2.0351: repeat_string() can be improved\n * 9.2.0350: Enabling modelines poses a risk\n * 9.2.0349: cannot style non-current window separator\n * 9.2.0348: potential buffer underrun when setting statusline like option\n * 9.2.0347: Vim9: script-local variable not found\n * 9.2.0346: Wrong cursor position when entering command line window\n * 9.2.0345: Wrong autoformatting with 'autocomplete'\n * 9.2.0344: channel: ch_listen() can bind to network interface\n * 9.2.0343: tests: test_clientserver may fail on slower systems\n * 9.2.0342: tests: test_excmd.vim leaves swapfiles behind\n * 9.2.0341: some functions can be run from the sandbox\n * 9.2.0340: pum_redraw() may cause flicker\n * 9.2.0339: regexp: nfa_regmatch() allocates and frees too often\n * 9.2.0338: Cannot handle mouseclicks in the tabline\n * 9.2.0337: list indexing broken on big-endian 32-bit platforms\n * 9.2.0336: libvterm: no terminal reflow support\n * 9.2.0335: json_encode() uses recursive algorithm\n * 9.2.0334: GTK: window geometry shrinks with with client-side decorations\n * 9.2.0333: filetype: PklProject files are not recognized\n * 9.2.0332: popup: still opacity rendering issues\n * 9.2.0331: spellfile: stack buffer overflows in spell file generation\n * 9.2.0330: tests: some patterns in tar and zip plugin tests not strict enough\n * 9.2.0329: tests: test_indent.vim leaves swapfiles behind\n * 9.2.0328: Cannot handle mouseclicks in the statusline\n * 9.2.0327: filetype: uv scripts are not detected\n * 9.2.0326: runtime(tar): but with dotted path\n * 9.2.0325: runtime(tar): bug in zstd handling\n * 9.2.0324: 0x9b byte not unescaped in \u003cCmd\u003e mapping\n * 9.2.0323: filetype: buf.lock files are not recognized\n * 9.2.0322: tests: test_popupwin fails\n * 9.2.0321: MS-Windows: No OpenType font support\n * 9.2.0320: several bugs with text properties\n * 9.2.0319: popup: rendering issues with partially transparent popups\n * 9.2.0318: cannot configure opacity for popup menu\n * 9.2.0317: listener functions do not check secure flag\n * 9.2.0316: [security]: command injection in netbeans interface via defineAnnoType\n * 9.2.0315: missing bound-checks\n * 9.2.0314: channel: can bind to all network interfaces\n * 9.2.0313: Callback channel not registered in GUI\n * 9.2.0312: C-type names are marked as translatable\n * 9.2.0311: redrawing logic with text properties can be improved\n * 9.2.0310: unnecessary work in vim_strchr() and find_term_bykeys()\n * 9.2.0309: Missing out-of-memory check to may_get_cmd_block()\n * 9.2.0308: Error message E1547 is wrong\n * 9.2.0307: more mismatches between return types and documentation\n * 9.2.0306: runtime(tar): some issues with lz4 support\n * 9.2.0305: mismatch between return types and documentation\n * 9.2.0304: tests: test for 9.2.0285 doesn't always fail without the fix\n * 9.2.0303: tests: zip plugin tests don't check for warning message properly\n * 9.2.0302: runtime(netrw): RFC2396 decoding double escaping spaces\n * 9.2.0301: Vim9: void function return value inconsistent\n * 9.2.0300: The vimball plugin needs some love\n * 9.2.0299: runtime(zip): may write using absolute paths\n * 9.2.0298: Some internal variables are not modified\n * 9.2.0297: libvterm: can improve CSI overflow code\n * 9.2.0296: Redundant and incorrect integer pointer casts in drawline.c\n * 9.2.0295: 'showcmd' shows wrong Visual block size with 'linebreak'\n * 9.2.0294: if_lua: lua interface does not work with lua 5.5\n * 9.2.0293: :packadd may lead to heap-buffer-overflow\n * 9.2.0292: E340 internal error when using method call on void value\n * 9.2.0291: too many strlen() calls\n * 9.2.0290: Amiga: no support for AmigaOS 3.x\n * 9.2.0289: 'linebreak' may lead to wrong Visual block highlighting\n * 9.2.0288: libvterm: signed integer overflow parsing long CSI args\n * 9.2.0287: filetype: not all ObjectScript routines are recognized\n * 9.2.0286: still some unnecessary (int) casts in alloc()\n * 9.2.0285: :syn sync grouphere may go beyond end of line\n * 9.2.0284: tabpanel: crash when tabpanel expression returns variable line count\n * 9.2.0283: unnecessary (int) casts before alloc() calls\n * 9.2.0282: tests: Test_viminfo_len_overflow() fails\n * 9.2.0281: tests: Test_netrw_FileUrlEdit.. fails on Windows\n","status":"published","published":"2026-05-08T10:39:48Z","modified":"2026-05-09T07:45:21.149316Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:2029-1","title":"Security update for vim","description":"This update for vim fixes the following issue:\n\nSecurity fixes:\n\n- CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).\n\nOther fixes:\n\n- Update to 9.2.0398.\n * 9.2.0398: MS-Windows: missing strptime() support\n * 9.2.0397: tabpanel: double-click opens a new tab\n * 9.2.0396: tests: Test_error_callback_terminal is flaky on macOS\n * 9.2.0395: tests: Test_backupskip() may read from $HOME\n * 9.2.0394: xxd: offsets greater than LONG_MAX print as negative\n * 9.2.0393: MS-Windows: link error with XPM support on UCRT64\n * 9.2.0392: tests: Some tests are flaky\n * 9.2.0391: tests: Comment in test_vim9_cmd breaks syntax highlighting\n * 9.2.0390: filetype: some Beancount files are not recognized\n * 9.2.0389: DECRQM still leaves stray 'pp' on Apple Terminal.app\n * 9.2.0388: strange indent in update_topline()\n * 9.2.0387: DECRQM request may leave stray chars in terminal\n * 9.2.0386: No scroll/scrollbar support in the tabpanel\n * 9.2.0385: Integer overflow with 'ze' and large 'sidescrolloff'\n * 9.2.0384: stale Insstart after \u003cCmd\u003e cursor move breaks undo\n * 9.2.0383: [security]: runtime(netrw): shell-injection via sftp: and file: URLs\n * 9.2.0382: Wayland: focus-stealing is non-working\n * 9.2.0381: Vim9: Missing check_secure() in exec_instructions()\n * 9.2.0380: completion: a few issues in completion code\n * 9.2.0379: gui.color_approx is never used\n * 9.2.0378: Using int as bool type in win_T struct\n * 9.2.0377: Using int as bool type in gui_T struct\n * 9.2.0376: Vim9: elseif condition compiled in dead branch\n * 9.2.0375: prop_find() does not find a virt text in starting line\n * 9.2.0374: c_CTRL-{G,T} does not handle offset\n * 9.2.0373: Ctrl-R mapping not triggered during completion\n * 9.2.0372: pum: rendering issues with multibyte text and opacity\n * 9.2.0371: filetype: ghostty config files are not recognized\n * 9.2.0370: duplicate code with literal string_T assignment\n * 9.2.0369: multiple definitions of STRING_INIT macro\n * 9.2.0368: too many strlen() calls when adding strings to dicts\n * 9.2.0367: runtime(netrw): ~ note expanded on MS Windows\n * 9.2.0366: pum: flicker when updating pum in place\n * 9.2.0365: using int as bool\n * 9.2.0364: tests: test_smoothscroll_textoff_showbreak() fails\n * 9.2.0363: Vim9: variable shadowed by script-local function\n * 9.2.0362: division by zero with smoothscroll and small windows\n * 9.2.0361: tests: no tests for ch_listen() with IPs\n * 9.2.0360: Cannot handle mouse-clicks in the tabpanel\n * 9.2.0359: wrong VertSplitNC highlighting on winbar\n * 9.2.0358: runtime(vimball): still path traversal attacks possible\n * 9.2.0357: [security]: command injection via backticks in tag files\n * 9.2.0356: Cannot apply 'scrolloff' context lines at end of file\n * 9.2.0355: runtime(tar): missing path traversal checks in tar#Extract()\n * 9.2.0354: filetype: not all Bitbake include files are recognized\n * 9.2.0353: Missing out-of-memory check in register.c\n * 9.2.0352: 'winhighlight' of left window blends into right window\n * 9.2.0351: repeat_string() can be improved\n * 9.2.0350: Enabling modelines poses a risk\n * 9.2.0349: cannot style non-current window separator\n * 9.2.0348: potential buffer underrun when setting statusline like option\n * 9.2.0347: Vim9: script-local variable not found\n * 9.2.0346: Wrong cursor position when entering command line window\n * 9.2.0345: Wrong autoformatting with 'autocomplete'\n * 9.2.0344: channel: ch_listen() can bind to network interface\n * 9.2.0343: tests: test_clientserver may fail on slower systems\n * 9.2.0342: tests: test_excmd.vim leaves swapfiles behind\n * 9.2.0341: some functions can be run from the sandbox\n * 9.2.0340: pum_redraw() may cause flicker\n * 9.2.0339: regexp: nfa_regmatch() allocates and frees too often\n * 9.2.0338: Cannot handle mouseclicks in the tabline\n * 9.2.0337: list indexing broken on big-endian 32-bit platforms\n * 9.2.0336: libvterm: no terminal reflow support\n * 9.2.0335: json_encode() uses recursive algorithm\n * 9.2.0334: GTK: window geometry shrinks with with client-side decorations\n * 9.2.0333: filetype: PklProject files are not recognized\n * 9.2.0332: popup: still opacity rendering issues\n * 9.2.0331: spellfile: stack buffer overflows in spell file generation\n * 9.2.0330: tests: some patterns in tar and zip plugin tests not strict enough\n * 9.2.0329: tests: test_indent.vim leaves swapfiles behind\n * 9.2.0328: Cannot handle mouseclicks in the statusline\n * 9.2.0327: filetype: uv scripts are not detected\n * 9.2.0326: runtime(tar): but with dotted path\n * 9.2.0325: runtime(tar): bug in zstd handling\n * 9.2.0324: 0x9b byte not unescaped in \u003cCmd\u003e mapping\n * 9.2.0323: filetype: buf.lock files are not recognized\n * 9.2.0322: tests: test_popupwin fails\n * 9.2.0321: MS-Windows: No OpenType font support\n * 9.2.0320: several bugs with text properties\n * 9.2.0319: popup: rendering issues with partially transparent popups\n * 9.2.0318: cannot configure opacity for popup menu\n * 9.2.0317: listener functions do not check secure flag\n * 9.2.0316: [security]: command injection in netbeans interface via defineAnnoType\n * 9.2.0315: missing bound-checks\n * 9.2.0314: channel: can bind to all network interfaces\n * 9.2.0313: Callback channel not registered in GUI\n * 9.2.0312: C-type names are marked as translatable\n * 9.2.0311: redrawing logic with text properties can be improved\n * 9.2.0310: unnecessary work in vim_strchr() and find_term_bykeys()\n * 9.2.0309: Missing out-of-memory check to may_get_cmd_block()\n * 9.2.0308: Error message E1547 is wrong\n * 9.2.0307: more mismatches between return types and documentation\n * 9.2.0306: runtime(tar): some issues with lz4 support\n * 9.2.0305: mismatch between return types and documentation\n * 9.2.0304: tests: test for 9.2.0285 doesn't always fail without the fix\n * 9.2.0303: tests: zip plugin tests don't check for warning message properly\n * 9.2.0302: runtime(netrw): RFC2396 decoding double escaping spaces\n * 9.2.0301: Vim9: void function return value inconsistent\n * 9.2.0300: The vimball plugin needs some love\n * 9.2.0299: runtime(zip): may write using absolute paths\n * 9.2.0298: Some internal variables are not modified\n * 9.2.0297: libvterm: can improve CSI overflow code\n * 9.2.0296: Redundant and incorrect integer pointer casts in drawline.c\n * 9.2.0295: 'showcmd' shows wrong Visual block size with 'linebreak'\n * 9.2.0294: if_lua: lua interface does not work with lua 5.5\n * 9.2.0293: :packadd may lead to heap-buffer-overflow\n * 9.2.0292: E340 internal error when using method call on void value\n * 9.2.0291: too many strlen() calls\n * 9.2.0290: Amiga: no support for AmigaOS 3.x\n * 9.2.0289: 'linebreak' may lead to wrong Visual block highlighting\n * 9.2.0288: libvterm: signed integer overflow parsing long CSI args\n * 9.2.0287: filetype: not all ObjectScript routines are recognized\n * 9.2.0286: still some unnecessary (int) casts in alloc()\n * 9.2.0285: :syn sync grouphere may go beyond end of line\n * 9.2.0284: tabpanel: crash when tabpanel expression returns variable line count\n * 9.2.0283: unnecessary (int) casts before alloc() calls\n * 9.2.0282: tests: Test_viminfo_len_overflow() fails\n * 9.2.0281: tests: Test_netrw_FileUrlEdit.. fails on Windows\n","status":"published","published":"2026-05-20T09:18:19Z","modified":"2026-05-21T08:15:07.039693204Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21414-1","title":"Security update for vim","description":"This update for vim fixes the following issue:\n\nUpdate to version 9.2.0398.\n\nSecurity issues fixed:\n\n- CVE-2026-39881: missing sanitization in `defineAnnoType` and `specialKeys` can lead to arbitrary Ex command injection\n  via a malicious NetBeans server (bsc#1261833).\n","status":"published","published":"2026-04-28T14:32:34Z","modified":"2026-05-01T18:27:05.328383Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21450-1","title":"Security update for vim","description":"This update for vim fixes the following issue:\n\nUpdate to version 9.2.0398.\n\nSecurity issues fixed:\n\n- CVE-2026-39881: missing sanitization in `defineAnnoType` and `specialKeys` can lead to arbitrary Ex command injection\n  via a malicious NetBeans server (bsc#1261833).\n","status":"published","published":"2026-04-29T11:30:37Z","modified":"2026-05-05T18:23:55.448308Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21833-1","title":"Security update for vim","description":"This update for vim fixes the following issues\n\n- CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).\n- CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin\n  bundled with Vim (bsc#1264706).\n- CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).\n- CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line\n  completion (bsc#1264707).\n- CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when\n  loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).\n- CVE-2026-46483: command injection via ` tar#Vimuntar()` in `runtime/autoload/tar.vim` when decompressing `.tgz`\n  archives on Unix-like systems (bsc#1265360).\n\nChanges for vim:\n\n- Update to v9.2.0530.\n- Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)\n","status":"published","published":"2026-05-28T12:10:45Z","modified":"2026-07-09T18:24:07.921760433Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21840-1","title":"Security update for vim","description":"This update for vim fixes the following issues\n\n- CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).\n- CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin\n  bundled with Vim (bsc#1264706).\n- CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).\n- CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line\n  completion (bsc#1264707).\n- CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when\n  loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).\n- CVE-2026-46483: command injection via ` tar#Vimuntar()` in `runtime/autoload/tar.vim` when decompressing `.tgz`\n  archives on Unix-like systems (bsc#1265360).\n\nChanges for vim:\n\n- Update to v9.2.0530.\n- Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)\n","status":"published","published":"2026-05-28T12:13:46Z","modified":"2026-05-31T18:24:29.077399124Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21859-1","title":"Security update for vim","description":"This update for vim fixes the following issues\n\n- CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).\n- CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin\n  bundled with Vim (bsc#1264706).\n- CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).\n- CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line\n  completion (bsc#1264707).\n- CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when\n  loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).\n- CVE-2026-46483: command injection via ` tar#Vimuntar()` in `runtime/autoload/tar.vim` when decompressing `.tgz`\n  archives on Unix-like systems (bsc#1265360).\n\nChanges for vim:\n\n- Update to v9.2.0530.\n- Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)\n","status":"published","published":"2026-05-28T12:13:46Z","modified":"2026-06-02T18:24:27.315181646Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2313-1","title":"Security update for vim","description":"This update for vim fixes the following issues\n\n- CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).\n- CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin\n  bundled with Vim (bsc#1264706).\n- CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).\n- CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line\n  completion (bsc#1264707).\n- CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when\n  loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).\n- CVE-2026-46483: command injection via ` tar#Vimuntar()` in `runtime/autoload/tar.vim` when decompressing `.tgz`\n  archives on Unix-like systems (bsc#1265360).\n\nChanges for vim:\n\n- Update to v9.2.0530.\n- Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)\n","status":"published","published":"2026-06-09T12:51:06Z","modified":"2026-06-10T18:24:12.088609343Z","updated_at":"2026-11-02T15:54:03.503431Z"}]}}