Skip to content

Vim Development Group · product

Vim

8 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.

  1. Format string vulnerability in the helptags_one function in src/ex_cmds.c in Vim 6.4 and earlier, and 7.x up to 7.1, allows user-assisted remote attackers to execute arbitrary cod…CVE-2007-2953Vim Development Group · 4.2% likely
  2. The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write f…CVE-2007-2438Vim Development Group · 3.2% likely
  3. vim 6.3 before 6.3.082, with modelines enabled, allows external user-assisted attackers to execute arbitrary commands via shell metacharacters in the (1) glob or (2) expand comman…CVE-2005-2368Vim Development Group · 2.7% likely

    CWE-78

  4. vim (aka gvim) processes VIM control codes that are embedded in a file, which could allow attackers to execute arbitrary commands when another user opens a file containing malicio…CVE-2001-0408Vim Development Group · 1.7% likely
  5. vim (aka gvim) allows local users to modify files being edited by other users via a symlink attack on the backup and swap files, when the victim is editing the file in a world wri…CVE-2001-0409Vim Development Group · 0.7% likely
  6. vim 6.0 and 6.1, and possibly other versions, allows attackers to execute arbitrary commands using the libcall feature in modelines, which are not sandboxed but may be executed wh…CVE-2002-1377Vim Development Group · 0.5% likely
  7. VIM before 6.3 and gVim before 6.3 allow local users to execute arbitrary commands via a file containing a crafted modeline that is executed when the file is viewed using options…CVE-2004-1138Vim Development Group · 0.4% likely
  8. The (1) tcltags or (2) vimspell.sh scripts in vim 6.3 allow local users to overwrite or create arbitrary files via a symlink attack on temporary files.CVE-2005-0069Vim Development Group · 0.4% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.