vim has 64 CVEs on record between 2021 and 2026. Disclosure cadence is accelerating: 10 in the last 90 days against 2 in the 90 before. The busiest recent month was August 2026 with 10. The median CVSS is 7.8 (high). None have a confirmed exploitation report. The dominant weakness classes are CWE-122 (15) and CWE-787 (13).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —
- Last 90 days
- 10 prev 2
Weakness classes
Products
- vim 64
64
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-73072High· 7.3Vim is an open source, command line text editor52CVE-2026-73078High· 8.8Vim is an open source, command line text editor48CVE-2026-47162High· 8.8Vim is an open source, command line text editor48CVE-2026-34982High· 8.2Vim is an open source, command line text editor45CVE-2021-3968High· 8.0vim is vulnerable to Heap-based Buffer Overflow44
vim vulnerabilities
CVEs affecting vim, newest first. Open any entry for full detail, references, and exploit status.
64 CVEsRSS
CVE-2021-3968High· 8.0⚖ disputedvim is vulnerable to Heap-based Buffer Overflow
vim is vulnerable to Heap-based Buffer Overflow
▾ Twilightvim · vimEPSS 2.2%via NVD
CVE-2021-3974High· 7.8⚖ disputedvim is vulnerable to Use After Free
vim is vulnerable to Use After Free
▾ Twilightvim · vimEPSS 1.4%via NVD
CVE-2021-3928High· 7.8vim is vulnerable to Use of Uninitialized Variable
vim is vulnerable to Use of Uninitialized Variable
▾ Twilightvim · vimEPSS 0.64%via NVD
CVE-2021-3927High· 7.8vim is vulnerable to Heap-based Buffer Overflow
vim is vulnerable to Heap-based Buffer Overflow
▾ Twilightvim · vimEPSS 1.7%via NVD