V
Vendor security profile
vim
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs88
Critical1
CISA KEV0
Public exploit62
Patch rate%95
Avg. CVSS7.3
12-month vulnerability rate
0
0
0
0
3
3
3
2
3
12
0
0
CVE KEV
CVE severity distribution
88toplam CVE
Critical1 (1%)
High69 (78%)
Medium17 (19%)
Low1 (1%)
Patch and exploitation view
%95
Verified patch
%0
CISA KEV
%70
Public exploit
84Patch available
0Partial
0Workaround
0Vendor: no patch
4Unknown
Latest vulnerabilities
7.8
CVE-2026-43961
Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution
V
Patch status unknownEPSS %0
7.1
CVE-2026-73073
Vim: Arbitrary Ex Command Execution in C Omni-Completion
V
Patch status unknownEPSS %0
8.6
CVE-2026-73078
Vim: Arbitrary Code Execution via Netrw Menu Construction
V
Patch verifiedEPSS %0
8.4
CVE-2026-73077
Vim: Arbitrary Code Execution via Shell Keyword Lookup
V
Patch verifiedEPSS %0
8.4
CVE-2026-73076
Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`
V
Patch verifiedEPSS %0
4.6
CVE-2026-73075
Vim: Out-of-bounds Access in Popup Opacity Handling
V
Patch verifiedEPSS %0
7.1
CVE-2026-73074
Vim: Heap Buffer Overflow in Text Property Handling
V
Patch verifiedEPSS %0
8.5
CVE-2026-73072
Vim: Heap Buffer Overflow when Loading a Spell File
V
Patch verifiedEPSS %0
3.3
CVE-2026-73071
Vim: Use-after-free in JSON Decoding
V
Patch verifiedEPSS %0
6.8
CVE-2026-73070
Vim: Stack Buffer Overflow in the Vim Socket Server
V
Patch verifiedEPSS %0