Vim
Vendor:
First CVE: Jun 16, 2008 · Active for 18 years
250
Total CVEs
Bottom 1%
20.8
Avg CVEs / Year
Bottom 1%
7.1
Avg CVSS
Higher Avg CVSS than 63% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Vim over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jun 16, 2008
18 years ago
Most Recent CVE
Jul 9, 2026
15 days ago
CVE Severity & Scoring
Vim250 CVEs
29%
68%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local217 (86.8%)
Network23 (9.2%)
Unknown10 (4.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low228 (91.2%)
High12 (4.8%)
Unknown10 (4.0%)
User Interaction
None30 (12.0%)
Unknown10 (4.0%)
Required210 (84.0%)
Privileges Required
Low28 (11.2%)
High0 (0.0%)
None212 (84.8%)
Unknown10 (4.0%)
Top CVEs
Signals from CVEs in this product scope (250 CVEs).
250 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-12735HIGH getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute | Jun 5, 2019 | 8.6 | 48 | NO | YES |
CVE-2008-2712HIGH Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the ex | Jun 16, 2008 | 9.3 | 43 | NO | YES |
CVE-2022-0572HIGH Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. | Feb 14, 2022 | 7.8 | 41 | NO | NO |
CVE-2008-4101HIGH Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands by entering a K keystroke on a | Sep 18, 2008 | 9.3 | 39 | NO | YES |
CVE-2026-59856HIGH Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken fro | Jul 9, 2026 | 7.8 | 37 | NO | NO |
CVE-2026-47162HIGH Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pa | Jun 11, 2026 | 8.8 | 37 | NO | NO |
CVE-2008-3076HIGH The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system funct | Feb 21, 2009 | 9.3 | 37 | NO | YES |
CVE-2026-59858HIGH Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension | Jul 9, 2026 | 7.8 | 36 | NO | NO |
CVE-2026-57456HIGH Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes r | Jun 25, 2026 | 7.8 | 35 | NO | NO |
CVE-2026-34714HIGH Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking | Mar 30, 2026 | 8.6 | 35 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (250 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
5 CVEs
2.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (250 CVEs).
Media Mentions
Signals from CVEs in this product scope (250 CVEs).
Top CNAs Publishing CVEs For Vim
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 9.1.0000 | 1 | 5.5 | 0.2% | 0 | 0 |
| 9.0.1367 | 1 | 7.8 | 0.4% | 0 | 0 |
| 8.2.2348 | 1 | 5.5 | 0.3% | 0 | 0 |
| 8.1.2135 | 1 | 9.8 | 1.5% | 0 | 0 |
| 8.0 | 1 | 7.8 | 1.1% | 0 | 0 |
| 7.2a.10 | 2 | 9.3 | 6.6% | 0 | 1 |
| 7.2 | 2 | 9.3 | 4.0% | 0 | 0 |
| 7.1.314 | 2 | 9.3 | 4.0% | 0 | 0 |
| 7.1.266 | 2 | 9.3 | 4.0% | 0 | 0 |
| 7.1 | 6 | 8.0 | 4.6% | 0 | 1 |
| 7.0 | 6 | 8.0 | 4.6% | 0 | 1 |
| 6.4 | 3 | 6.6 | 5.5% | 0 | 1 |
| 6.3 | 4 | 6.7 | 6.3% | 0 | 2 |
| 6.2 | 4 | 6.7 | 6.3% | 0 | 2 |
| 6.1 | 3 | 6.6 | 5.5% | 0 | 1 |
| 6.0 | 3 | 6.6 | 5.5% | 0 | 1 |
| 5.8 | 3 | 6.6 | 5.5% | 0 | 1 |
| 5.7 | 3 | 6.6 | 5.5% | 0 | 1 |
| 5.6 | 3 | 6.6 | 5.5% | 0 | 1 |
| 5.5 | 3 | 6.6 | 5.5% | 0 | 1 |